A malformed token entry such as <0x-1> triggers a heap out‑of‑bounds write in the plamo2 tokenizer’s build routine. When a GGUF model is loaded, the parser interprets the negative value and writes token identifiers before the allocated byte buffer, corrupting heap memory. This overflow can cause the application to crash or, if the corrupted data is leveraged appropriately, lead to arbitrary code execution, as classified under CWE‑129.

The issue is present in ggml‑org:llama.cpp builds from commit b5899 up to, but excluding, b10261. Any deployment that loads GGUF models using a version in this range and does not install the b10261 patch is vulnerable.

The assigned CVSS score of 8.5 reflects high severity. EPSS data is currently unavailable and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to supply a specially crafted GGUF file to the target application, whether via direct model upload, file inclusion, or any service that processes external model files. Successful exploitation could cause a crash or, depending on heap state, result in code execution.