llama.cpp before b3701 contains an out-of-bounds read vulnerability in llama_decode_internal and llama_encode_internal that allows remote unauthenticated attackers to read memory by supplying unvalidated token IDs. Attackers can send integer-array prompts to the llama-server /completion endpoint with IDs outside 0 to n_vocab to read embedding memory out of bounds or crash the process.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 8
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-27 14:14
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-27 23:10
- StatusAwaiting Analysis → PublishedNVD modified 2026-10-27 14:14
- StatusPublished → Awaiting AnalysisNVD modified 2026-10-27 15:59
- StatusReceived → PublishedNVD modified 2026-10-27 14:14
- StatusPublished → ReceivedNVD modified 2026-10-27 14:16
- StatusReceived → PublishedNVD modified 2026-10-27 00:33
- First seenCVSS 8.8NVD modified 2026-10-27 01:19
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 6
- https://github.com/ggml-org/llama.cpp/blob/b3681/examples/server/server.cpp#L789
- https://github.com/ggml-org/llama.cpp/commit/eae597182cb61bbde0b26e7cec5999d28b9327fe
- https://github.com/ggml-org/llama.cpp/commit/faf69d4237c9ae4d7f572b4674d1002463e8acd3
- https://github.com/ggml-org/llama.cpp/pull/9359
- https://github.com/ggml-org/llama.cpp/releases/tag/b3701
- https://www.vulncheck.com/advisories/llama-cpp-before-b3701-out-of-bounds-read-in-llama-decode-via-token-ids