CVE-2025-53630: llama.cpp Buffer Overflow Vulnerability

CVE-2025-53630 Overview

CVE-2025-53630 is an integer overflow vulnerability in llama.cpp, an open source C/C++ inference engine for large language models. The flaw resides in the gguf_init_from_file_impl function in ggml/src/gguf.cpp, where tensor size accumulation can overflow size_t. The overflow produces an undersized allocation that leads to heap out-of-bounds reads and writes during GGUF (GPT-Generated Unified Format) model file parsing. An attacker who supplies a crafted GGUF model file can trigger memory corruption inside any process that loads it. The issue is fixed in commit 26a48ad699d50b6268900062661bd22f3e792579.

Critical Impact
A malicious GGUF model file can corrupt heap memory in any application or service that loads models through llama.cpp, enabling potential code execution or denial of service.

Affected Products

llama.cpp (ggml/src/gguf.cpp) prior to commit 26a48ad699d50b6268900062661bd22f3e792579
Downstream applications and services that embed vulnerable llama.cpp builds for GGUF model loading
LLM inference stacks and tooling that accept untrusted GGUF model files

Discovery Timeline

2025-07-10 - CVE-2025-53630 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-53630

Vulnerability Analysis

The vulnerability is a heap-based integer overflow classified under [CWE-122]. During GGUF file parsing, gguf_init_from_file_impl iterates over tensor descriptors and accumulates each tensor's padded byte size into ctx->size. The addition ctx->size += GGML_PAD(ggml_nbytes(&ti.t), ctx->alignment) is performed without bounds checking. A crafted GGUF file containing tensor dimensions chosen so their padded sizes sum past SIZE_MAX wraps the accumulator to a small value. Subsequent buffer allocations sized from ctx->size are too small to contain the real tensor data, and later read/write operations stride past the allocation boundary, corrupting adjacent heap memory.

Root Cause

The root cause is missing arithmetic validation on attacker-controlled tensor metadata. The parser trusted the size values declared inside the GGUF file and accumulated them directly into a size_t without checking for wraparound prior to allocation.

Attack Vector

Exploitation requires the target process to load a GGUF model supplied by the attacker. This is reachable in any deployment that accepts third-party model files, model hubs, inference servers exposing upload endpoints, or developer tooling that downloads models over the network. No authentication or user interaction is required beyond loading the file.

cpp

// Patch from upstream commit 26a48ad699d50b6268900062661bd22f3e792579
// File: ggml/src/gguf.cpp
                 gguf_free(ctx);
                 return nullptr;
             }
-            ctx->size += GGML_PAD(ggml_nbytes(&ti.t), ctx->alignment);
+            size_t padded_size = GGML_PAD(ggml_nbytes(&ti.t), ctx->alignment);
+            if (SIZE_MAX - ctx->size < padded_size) {
+                GGML_LOG_ERROR("%s: tensor '%s' size overflow, cannot accumulate size %zu + %zu\n",
+                    __func__, ti.t.name, ctx->size, padded_size);
+                gguf_free(ctx);
+                return nullptr;
+            }
+            ctx->size += padded_size;
         }
     }

Source: llama.cpp commit 26a48ad

The patch computes the padded tensor size into a local variable and checks SIZE_MAX - ctx->size < padded_size before adding. When the check fails, the context is freed and parsing aborts, preventing the undersized allocation that drives the out-of-bounds access.

Detection Methods for CVE-2025-53630

Indicators of Compromise

GGUF model files originating from untrusted sources or unverified mirrors, particularly those with abnormally large or inconsistent tensor dimension fields in the header.
Crashes, aborts, or AddressSanitizer heap-buffer-overflow reports emitted by processes running llama.cpp shortly after a model load.
New or unexpected GGUF files dropped into model directories monitored by inference services.

Detection Strategies

Statically inspect GGUF headers before loading and reject files whose summed padded tensor sizes approach or exceed SIZE_MAX.
Run llama.cpp builds compiled with AddressSanitizer in test environments to surface the out-of-bounds access on candidate model files.
Hash-pin known-good GGUF models and alert when inference hosts load files whose SHA-256 is not on the allowlist.

Monitoring Recommendations

Log every GGUF model load event with file path, hash, source, and the loading process identifier.
Monitor inference service processes for abnormal termination, segmentation faults, and unexpected child process creation following model load.
Track outbound network connections from model-loading hosts to detect post-exploitation command-and-control activity.

How to Mitigate CVE-2025-53630

Immediate Actions Required

Update llama.cpp to a build that includes commit 26a48ad699d50b6268900062661bd22f3e792579 or later and rebuild all dependent binaries and language bindings.
Inventory every application, container image, and Python wheel that statically links or bundles llama.cpp or ggml, and patch each one.
Restrict GGUF model loading to files retrieved from trusted, integrity-verified sources.

Patch Information

The fix is upstream commit 26a48ad699d50b6268900062661bd22f3e792579. Additional context is available in the GitHub Security Advisory GHSA-vgg9-87g3-85w8. Rebuild and redeploy any service that vendors llama.cpp headers or static libraries.

Workarounds

Disable loading of GGUF files originating from untrusted users or remote sources until patched binaries are deployed.
Run inference workloads in sandboxed containers with seccomp filters, read-only model directories, and minimal filesystem and network privileges.
Validate the hash of each GGUF model against an internal allowlist before invoking gguf_init_from_file.

bash

# Verify llama.cpp build includes the fix
cd llama.cpp
git log --oneline | grep 26a48ad

# Pin model loads to known-good hashes
sha256sum /opt/models/*.gguf > /etc/inference/models.sha256
sha256sum -c /etc/inference/models.sha256

# Run inference under a restrictive sandbox
docker run --rm --read-only --cap-drop=ALL \
  --security-opt no-new-privileges \
  -v /opt/models:/models:ro \
  llama-cpp:patched --model /models/verified.gguf