llama.cpp CVE-2026-18581

Exploitation requires local access to the system running llama.cpp and a low-privileged OS account (PR:L per CVSS 4.0 vector). The attacker must be able to supply template input directly to the llama.cpp Jinja template parser - specifically the input {{9|9|{ or a similar malformed filter-chain sequence. This limits exploitation to environments where untrusted users can submit template strings to llama.cpp, such as shared inference endpoints or developer workstations where multiple users have shell access. Exploitation is constrained by: local-only attack surface (no network-exploitable path), low-privilege requirement (a valid OS account is needed), and impact limited to crashing the llama.cpp process with no code execution or data access. Default single-user desktop deployments face negligible risk since the user running llama.cpp can already crash the process through normal OS mechanisms.

Real-world risk is low. The CVSS 4.0 score of 1.9 accurately reflects the limited blast radius: exploitation is strictly local (AV:L), requires low privileges (PR:L), and produces only a local availability impact (VA:L) with no confidentiality or integrity consequences (VC:N/VI:N). There is no network-exploitable surface and no data exfiltration path. The existence of a public POC (E:P in the CVSS 4.0 supplemental metrics) raises the likelihood of exploitation slightly but does not change the impact profile. The vulnerability is not listed in CISA KEV, and no EPSS data was provided. SSVC signals: exploitation is possible but not widespread; the attack is not automatable at scale due to the local access requirement; technical impact is partial (availability only). This is a genuine but low-severity local DoS - not a priority unless llama.cpp is deployed in a multi-user or shared inference environment where untrusted users can supply template inputs. The primary risk scenario is a denial-of-service against a local AI inference service rather than remote compromise.

A low-privileged local user on a system running llama.cpp as a shared inference service crafts a prompt template containing the malformed filter chain {{9|9|{ and submits it to the llama.cpp process. The Jinja Minja parser in common/jinja/parser.cpp hits the reachable assertion, causing the process to abort immediately. A public proof-of-concept demonstrating this crash is available on Proton Drive (linked in the VulDB submission), confirming the reproducibility of the crash sequence.