Which versions of llama.cpp are affected by CVE-2026-43632?

llama.cpp's tokenization service components contain a use-after-free vulnerability (CVE-2026-43632, CVSS 9.2) affecting builds b7492 through b9060 that could allow remote attackers to crash the…

How to fix or mitigate CVE-2026-43632?

Within 24 hours, identify all instances of llama.cpp server in your environment, specifically those launched with the --sleep-idle-seconds flag, and document their configuration and usage. Within 7 days, immediately disable the --sleep-idle-seconds parameter on affected deployments (this is the critical mitigation) or upgrade llama.cpp to a build version after b9060, once available. Within 30 days, monitor llama.cpp project releases closely for patched versions addressing CVE-2026-43632, establish a vendor advisory subscription for llama.cpp, and implement network segmentation to restrict access to llama-server endpoints to trusted internal systems only.

llama.cpp CVE-2026-43632

Q: What is the CVSS score of CVE-2026-43632?

CVE-2026-43632 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-54287 CRITICAL

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-08-06 disclosure@vulncheck.com

GHSA-3f2h-96vw-c84x

RCE

9.2

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable and unauthenticated (AV:N/PR:N), but AC:H reflects the hard-to-win TOCTOU race plus the non-default --sleep-idle-seconds precondition; heap UAF supports high CIA potential.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.1 HIGH

qualitative

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 23:02 vuln.today

CVE Published

Aug 06, 2026 - 22:17 cve.org

CRITICAL 9.2

DescriptionCVE.org

llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in llama-server affecting six tokenization endpoints (/tokenize, /detokenize, /infill, /apply-template, /rerank, and /anthropic/count_tokens) that bypass the task queue and access ctx_server.vocab directly on HTTP worker threads. Attackers can exploit a time-of-check-time-of-use race condition where the main thread destroys and frees vocab after the synchronization lock is released but before the handler finishes using it, causing a crash or potential code execution when --sleep-idle-seconds is configured.

AnalysisAI

Use-after-free in the llama-server component of llama.cpp (builds b7492 through b9060) lets remote unauthenticated attackers crash the server or potentially execute code by racing six tokenization endpoints (/tokenize, /detokenize, /infill, /apply-template, /rerank, /anthropic/count_tokens) that read ctx_server.vocab directly on HTTP worker threads instead of going through the task queue. The flaw is only reachable when the server is started with --sleep-idle-seconds, since idle-driven vocab teardown on the main thread is what frees the object mid-handler. No public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 9.2 but real-world exploitation is constrained by a hard-to-win TOCTOU race.

Technical ContextAI

llama.cpp is a widely used C/C++ inference runtime for GGUF LLM models, and llama-server is its bundled HTTP server exposing REST endpoints for tokenization, templating, reranking, and generation. The root cause is CWE-367 (Time-of-Check Time-of-Use race condition): six endpoints short-circuit the normal task-queue synchronization and dereference the shared ctx_server.vocab object directly from HTTP worker threads. When --sleep-idle-seconds is configured, the main thread tears down and frees the model context (including vocab) after an idle window. Because the worker thread reads vocab after the synchronization lock is released but before it finishes using the pointer, the main thread can destroy and free that memory underneath an in-flight request, turning a benign read into a use-after-free on freed heap memory.

RemediationAI

Patch available per third-party advisory: the referenced repository https://github.com/Vladimir-tokarev-cyera/llama-cpp-security-patches provides fixes routing the six endpoints through the task queue rather than accessing ctx_server.vocab directly; a specific patched llama.cpp build/tag was not provided and could not be independently confirmed, so upgrade to the latest official build once the fix is merged upstream and verify the tokenization endpoints no longer bypass synchronization. As an immediate compensating control, do not run llama-server with --sleep-idle-seconds - removing that flag eliminates the vocab teardown that frees the object mid-request and closes the race entirely, at the cost of keeping the model resident in memory (higher idle RAM/VRAM usage). Additionally, restrict network exposure of llama-server: bind to localhost or place it behind an authenticating reverse proxy and block direct internet access to /tokenize, /detokenize, /infill, /apply-template, /rerank, and /anthropic/count_tokens, since the endpoints are unauthenticated by design.