CVE-2025-6208 is a resource exhaustion vulnerability classified under CWE-400, found in the SimpleDirectoryReader component of the run-llama/llama_index library, specifically in version 0.12.23. The vulnerability arises because the component loads all files from a directory into memory before applying the user-specified limit on the number of files to process (num_files_limit). This design flaw leads to uncontrolled memory consumption, as the system may attempt to load an excessive number of files into memory simultaneously, causing memory exhaustion. This can degrade system performance or cause crashes, particularly in resource-constrained environments such as cloud instances with limited RAM or embedded systems. The vulnerability does not require any privileges or user interaction to be triggered, making it remotely exploitable if the library is used in exposed services. The issue is resolved in version 0.12.41, where the file limit is enforced prior to loading files into memory, preventing excessive resource consumption. There are no known exploits in the wild at this time, and the CVSS v3.0 base score is 5.3 (medium severity), reflecting the impact on availability without affecting confidentiality or integrity.

For European organizations, the primary impact of CVE-2025-6208 is the potential for denial of service through memory exhaustion when processing directories with many files using the vulnerable version of the llama_index library. This can disrupt business operations, especially for organizations relying on AI or data processing pipelines that integrate run-llama components. Systems with limited memory resources, such as edge devices or smaller cloud instances, are particularly vulnerable. While the vulnerability does not compromise data confidentiality or integrity, the availability impact can lead to downtime, degraded performance, and increased operational costs. Organizations in sectors with high reliance on AI-driven document processing or indexing, such as finance, healthcare, and government, may face operational risks if unpatched. Additionally, service providers hosting applications using this library could experience customer impact and reputational damage if affected by outages.

European organizations should immediately upgrade the run-llama/llama_index library to version 0.12.41 or later, where the vulnerability is fixed. Until the upgrade is applied, implement strict resource limits at the operating system or container level to restrict memory usage of processes using the vulnerable component. Additionally, configure monitoring and alerting for abnormal memory consumption patterns in applications that utilize the SimpleDirectoryReader. If possible, limit the size and number of files in directories processed by the component to reduce risk. Conduct code reviews and dependency audits to identify any indirect usage of the vulnerable library in third-party applications. For environments where upgrading is delayed, consider isolating affected services to minimize impact on critical systems. Finally, maintain an inventory of applications using run-llama components to ensure comprehensive patching.