The vulnerability is an out-of-bounds read in llama.cpp’s recurrent memory state restore path, present in builds between commits b4882 and b8487. An attacker with write permission to the slot save directory can create a malicious slot file with an oversized seq_id that causes the code to read memory beyond the allocated cells array. The out-of-bounds read exposes heap data—including pointer values—to server logs, breaking ASLR and potentially aiding further attacks. The flaw is assigned CWE‑125 and CWE‑209.

The issue affects llama.cpp builds from commit b4882 up to, but not including, commit b8487. Users deploying these builds—whether compiled directly or embedded in downstream applications—are at risk unless the commit that patches the out-of-bounds read is applied.

The CVSS score of 6.3 classifies the flaw as moderate. The EPSS score is under 1%, indicating a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack requires write access to the slot save directory, limiting the attack surface to environments where a user can create or modify slot files. If such access exists, the attacker can exfiltrate heap memory, defeat ASLR, and potentially set the stage for subsequent exploitation.