EUVD-2026-54286
GHSA-6hc7-9rph-cm99
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed llama-server endpoint
-
DeliveryTime requests to idle-sleep transition
-
ExploitTrigger vocab pointer free (race)
-
ExecutionSpray heap to reclaim freed allocation
-
PersistDereference dangling vocab with controlled data
-
ImpactExecute arbitrary code as server process
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that llama-server be started with the --sleep-idle-seconds feature enabled - this is the exact configuration prerequisite and it is not a default. The attacker must send requests to reachable llama-server endpoints during the precise moment the server transitions into sleep mode, so success depends on hitting a narrow timing window (reflected as AC:H and AT:P in the CVSS 4.0 vector) and typically requires heap grooming to reclaim the freed vocab allocation with controlled data. Per PR:N/UI:N no authentication or user interaction is needed. Limiting factors: instances without --sleep-idle-seconds are not affected, the race is non-deterministic and may require repeated attempts, and reachability depends on llama-server being network-exposed rather than bound to localhost. |
| Impact | The signals partially conflict and must be weighed carefully. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N with VC:H/VI:H/VA:H) yields a 9.2 CRITICAL score reflecting unauthenticated network-reachable full RCE, but the AC:H and AT:P metrics explicitly encode that success depends on winning a narrow race window during the sleep transition and on the presence of specific runtime conditions - this is not a trivially reliable one-shot exploit. No EPSS score was provided, so real-world exploitation probability cannot be quantified from the input. It is NOT listed in CISA KEV and no POC is referenced, so there is no evidence of active exploitation. Critically, exploitation requires the non-default --sleep-idle-seconds feature to be enabled, which sharply narrows the exposed population versus the raw CRITICAL score. Net: a genuinely severe flaw where it applies, but real-world priority is bounded by the non-default configuration and heap-grooming/timing difficulty; treat as high priority only for operators who run llama-server with idle-sleep enabled on reachable networks. |
| Exploit ScenarioDerived | An attacker who can reach an internet- or LAN-exposed llama-server instance running with --sleep-idle-seconds enabled floods the completion endpoint precisely as the server begins its idle-to-sleep transition, so a worker thread dereferences the freed vocab pointer. By spraying the heap with crafted request data to reclaim the freed allocation, the attacker steers the dangling pointer to attacker-controlled contents and achieves arbitrary code execution as the server process. No POC is referenced, and the AC:H/AT:P metrics mean the attacker likely needs many timing attempts to win the race. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 06, 2026
Remote code execution in llama.cpp's llama-server (builds b7492 through b9060) allows unauthenticated attackers to run arbitrary code by racing the server's idle-sleep transition when the --sleep-idle-seconds feature is enabled. Concurrent worker threads dereference a freed vocab pointer that can be reclaimed with attacker-controlled data. No public exploit identified at time of analysis, and the flaw is not in CISA KEV; exploitation is gated by a non-default configuration and a tight timing window (CVSS 4.0 base 9.2, AT:P/AC:H).
RemediationAI
No vendor-released patched build version is confirmed in the provided data; the only fix pointer is a third-party GitHub security-patches repository (https://github.com/Vladimir-tokarev-cyera/llama-cpp-security-patches), so an upstream fix may exist but a released patched build is not independently confirmed - verify against the official ggml-org/llama.cpp releases before relying on a specific build. As an immediate and highly effective compensating control, disable the idle-sleep feature by not passing --sleep-idle-seconds (or setting it so the server never unloads), which removes the vulnerable teardown path entirely at the cost of higher steady-state memory/GPU usage since the model stays resident. Additionally, do not expose llama-server directly to untrusted networks: bind to localhost and place it behind an authenticating reverse proxy or restrict the listening port via firewall to trusted clients, which reduces reachability but does not fix the underlying race. Upgrade to an official patched build as soon as ggml-org confirms one.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
llama.cpp is a widely used C/C++ inference engine for running GGUF large language models locally; llama-server is its HTTP serving front-end that exposes completion/embedding endpoints and dispatches requests across worker threads. The root cause is CWE-362 (race condition / improper synchronization of a shared resource): the vocab object owned by the model context is freed as part of the --sleep-idle-seconds idle-unload path, while in-flight worker threads still hold and dereference the now-dangling vocab pointer. This is a classic use-after-free reached through a time-of-check/time-of-use gap between the sleep-transition teardown and concurrent request handling. No CPE strings were supplied in the input, so exact affected configurations are drawn from the description's build-number range rather than an NVD CPE match.
Know when Llama Cpp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Unauthenticated network RCE (PR:N/UI:N, C/I/A:H) but AC:H because success depends on winning the sleep-transition race; same-process worker corruption means S:U.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in the vocab pointer of llama-server when the --sleep-idle-seconds feature is enabled, allowing unauthenticated remote attackers to execute arbitrary code. Attackers can trigger the vulnerability by sending requests to affected endpoints while the server transitions to sleep mode, causing concurrent worker threads to dereference a freed vocab pointer that can be reclaimed with attacker-controlled data to achieve remote code execution.
Executive ViewAI
A critical vulnerability in llama.cpp's llama-server (builds b7492-b9060) can allow unauthenticated remote attackers to gain unauthorized control over affected systems; no public exploit identified at time of analysis. Organizations deploying this open-source LLM tool with idle-sleep functionality enabled face immediate risk of complete system compromise, data loss, and operational disruption. Rapid identification and remediation of affected deployments is essential.
No vendor-released patch identified at time of analysis. Disable the --sleep-idle-seconds feature immediately on all affected instances; restrict network access to llama-server to trusted internal subnets only; run llama-server in a containerized environment with minimal host access; monitor vendor communications for patch availability and establish a testing plan for rapid deployment when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Arbitrary memory write in llama.cpp's RPC server allows remote unauthenticated attackers to corrupt arbitrary memory add
Remote code execution in llama.cpp (commit 18c2e17) is possible when a user opens a malicious .gguf model file, triggeri
Llama.cpp server endpoints fail to validate the n_discard parameter from JSON input, allowing negative values that trigg
Remote code execution in llama.cpp (commit 18c2e17) is possible when a victim loads a malicious .gguf model file, trigge
Remote code execution in llama.cpp (GGUF library) allows attackers to achieve arbitrary code execution by tricking a use
Remote code execution in llama.cpp (commit 18c2e17) occurs when the GGUF library's gguf_fread_str function parses a mali
Heap-based buffer overflow in llama.cpp's GGUF library header parser (commit 18c2e17) enables code execution when a vict
CVE-2025-52566 is a signed vs. unsigned integer overflow vulnerability in llama.cpp's tokenizer (llama_vocab::tokenize f
Remote code execution in llama.cpp RPC backend allows unauthenticated attackers with TCP access to achieve arbitrary mem
llama.cpp provides LLM inference in C/C++. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable,
Heap buffer overflow in llama.cpp's server KV cache state-restore path (builds b4882 through b9058) lets an attacker who
Use-after-free in the llama-server component of llama.cpp (builds b7492 through b9060) lets remote unauthenticated attac
Exploit-DB