llama.cpp is an inference of several LLM models in C/C++. Prior to version b5721, there is a signed vs. unsigned integer overflow in llama.cpp's tokenizer implementation (llama_vocab::tokenize) (src/llama-vocab.cpp:3036) resulting in unintended behavior in tokens copying size comparison. Allowing heap-overflowing llama.cpp inferencing engine with carefully manipulated text input during tokenization process. This issue has been patched in version b5721.
{
"cwe_ids": [
"CWE-119",
"CWE-195"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52566.json",
"cna_assigner": "GitHub_M"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-52566.json"
"2026-04-12T17:57:45Z"
[
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 514.0,
"function_hash": "270077148383860391570221041500364193616"
},
"source": "https://github.com/ggml-org/llama.cpp/commit/dd6e6d0b6a4bbe3ebfc931d1eb14db2f2b1d70af",
"id": "CVE-2025-52566-407f697f",
"signature_type": "Function",
"target": {
"function": "common_tokenize",
"file": "common/common.cpp"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"91470867438543637673356216369338370141",
"115884794377356128160398127090786270422",
"30538972754053711544239847119938613292",
"212862534274816134989569290588858028551"
]
},
"source": "https://github.com/ggml-org/llama.cpp/commit/dd6e6d0b6a4bbe3ebfc931d1eb14db2f2b1d70af",
"id": "CVE-2025-52566-579e6ab0",
"signature_type": "Line",
"target": {
"file": "common/common.cpp"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"187346091326280732131644842382811957673",
"158166800848300285018590514287286622757",
"63085624961053815001998246799825457650",
"237697994035413936334644721475303108970"
]
},
"source": "https://github.com/ggml-org/llama.cpp/commit/dd6e6d0b6a4bbe3ebfc931d1eb14db2f2b1d70af",
"id": "CVE-2025-52566-9a237408",
"signature_type": "Line",
"target": {
"file": "src/llama-vocab.cpp"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 406.0,
"function_hash": "102397014676704209984940338416881180188"
},
"source": "https://github.com/ggml-org/llama.cpp/commit/dd6e6d0b6a4bbe3ebfc931d1eb14db2f2b1d70af",
"id": "CVE-2025-52566-befe16b8",
"signature_type": "Function",
"target": {
"function": "llama_vocab::tokenize",
"file": "src/llama-vocab.cpp"
}
}
]