EUVD-2026-64001
GHSA-fpvp-jgx3-4w9q
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network access to the RPC listener gives PR:N/AV:N; AC:H reflects the required heap-reclamation race; UAF yields full C/I/A with no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
llama.cpp before b8585 contains a use-after-free vulnerability in the RPC server's GRAPH_RECOMPUTE handler that allows unauthenticated remote attackers to achieve arbitrary read and write access by storing a computation graph, freeing referenced buffers, and reclaiming freed memory with attacker-controlled content. Attackers can send RPC requests to trigger re-execution of stored graphs with dangling pointers, enabling full remote code execution without requiring authentication or user interaction.
AnalysisAI
Remote code execution in llama.cpp (ggml-org) prior to build b8585 arises from a use-after-free in the RPC server's GRAPH_RECOMPUTE handler, letting unauthenticated remote attackers gain arbitrary memory read/write and ultimately full RCE on any host exposing the distributed-inference RPC backend. An attacker stores a computation graph, frees the buffers it references, then reclaims that freed memory with attacker-controlled content before triggering re-execution against the dangling pointers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the llama.cpp RPC server backend to be running and network-reachable by the attacker (the rpc-server binary or a build launched with the --rpc option); a standard standalone llama.cpp/llama-server instance without the RPC backend is not exposed to this handler. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely high-priority issue where the RPC backend is exposed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An organization runs several llama.cpp rpc-server worker nodes reachable on an internal network to distribute inference. An attacker who reaches that network sends a crafted sequence of RPC messages to store a computation graph, free its backing buffers, and reallocate that memory with controlled bytes, then issues GRAPH_RECOMPUTE to execute against the dangling pointers - yielding arbitrary read/write and code execution on the worker without any credentials. … |
| Remediation | Vendor-released patch: b8585 - upgrade llama.cpp to build b8585 or later, using the official release binaries for your platform (macOS arm64/x64, Linux Ubuntu/s390x with CPU/Vulkan/ROCm/OpenVINO variants, or Windows CPU/CUDA builds) from https://github.com/ggml-org/llama.cpp/releases/tag/b8585; the fix is commit 389c7d4955ba55c7418afaebf7c23d9ed64ef707 via PR https://github.com/ggml-org/llama.cpp/pull/21175. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all llama.cpp deployments, identify build versions, and determine network exposure of RPC endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary memory write in llama.cpp's RPC server allows remote unauthenticated attackers to corrupt arbitrary memory add
Remote code execution in llama.cpp (commit 18c2e17) is possible when a user opens a malicious .gguf model file, triggeri
Remote code execution in llama.cpp (commit 18c2e17) is possible when a victim loads a malicious .gguf model file, trigge
Remote code execution in llama.cpp (GGUF library) allows attackers to achieve arbitrary code execution by tricking a use
Remote code execution in llama.cpp (commit 18c2e17) occurs when the GGUF library's gguf_fread_str function parses a mali
Heap-based buffer overflow in llama.cpp's GGUF library header parser (commit 18c2e17) enables code execution when a vict
Remote code execution in llama.cpp RPC backend allows unauthenticated attackers with TCP access to achieve arbitrary mem
llama.cpp provides LLM inference in C/C++. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable,
Llama.cpp is LLM inference in C/C++. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no auth
Heap corruption via mismatched memory management in llama.cpp's LLaMA-Android JNI wrapper affects builds b1886 through b
Remote code execution in llama.cpp prior to commit b7824 is possible through a crafted GGUF file that exploits an intege
Local attackers can achieve heap buffer overflow in llama.cpp versions before b8146 through integer overflow in the GGUF
Same weakness CWE-416 – Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today