PT-2026-68730 · Llama.Cpp · Llama.Cpp
CVE-2026-43631
·
Published
2026-08-06
·
Updated
2026-08-07
CVSS v4.0
9.2
Critical
| Vector | AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
llama.cpp versions b7492 through b9060
Description
A use-after-free issue exists in the
llama-server when the --sleep-idle-seconds feature is enabled. This occurs when the server transitions to sleep mode, causing concurrent worker threads to dereference a freed vocab pointer. An unauthenticated remote attacker can exploit this by sending requests to affected endpoints, potentially reclaiming the freed pointer with controlled data to achieve remote code execution.Recommendations
Update llama.cpp to a version later than b9060.
As a temporary mitigation, disable the
--sleep-idle-seconds feature.Fix
RCE
Race Condition
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Llama.Cpp