Ggerganov

An out-of-bounds read exists in the `llama decode internal()` and `llama encode internal()` functions. Remote unauthenticated attackers can read memory or cause a process crash by providing unvalidated token IDs. This is achieved by sending integer-array prompts to the `/completion` endpoint with IDs that fall outside the 0 to `n vocab` range, allowing access to embedding memory outside the intended boundaries.

A heap out-of-bounds read occurs in the `llama vocab::impl::print info()` function. This issue allows an attacker to crash the model loading process by providing a specially crafted GGUF model containing oversized special token IDs and a short `tokenizer.ggml.tokens` array. This causes `llama-cli` or `llama-server` to read past the `id to token` boundary, resulting in a crash.