Llama Cpp EUVD-2026-17975

llama.cpp RPC backend must be exposed on network with TCP access. Attacker sends crafted GRAPH_COMPUTE messages with zero buffer field to bypass bounds validation in deserialize_tensor(). No authentication required. Affects versions prior to b8492. Default RPC configurations are vulnerable.

This vulnerability represents critical real-world risk across multiple threat intelligence signals. The CVSS 9.8 score accurately reflects severity: network attack vector (AV:N) enables remote exploitation, low complexity (AC:L) requires no special conditions, and no privileges or user interaction needed (PR:N/UI:N) maximizes attacker accessibility. The complete impact triad (C:H/I:H/A:H) confirms arbitrary code execution capability. While no public exploit identified at time of analysis and not listed in CISA KEV, the GitHub Security Advisory (GHSA-j8rj-fmpv-wcxw) provides detailed technical analysis including specific vulnerable functions and exploitation primitives (pointer leaks, ASLR bypass techniques). The RPC backend is network-exposed by design, and unauthenticated access means any attacker with TCP connectivity can exploit this. For organizations running llama.cpp RPC servers exposed to untrusted networks, this is an immediate patch priority. The combination of detailed public disclosure, network accessibility, and no authentication barrier significantly elevates exploitation probability despite absence of confirmed active exploitation. SSVC framework indicates immediate action required: exploitation technically feasible, automatable due to network protocol nature, and technical impact corresponds to total system compromise.

An attacker identifies an internet-exposed llama.cpp RPC server port through network scanning. Without authentication, they establish a TCP connection and send specially crafted ALLOC_BUFFER and BUFFER_GET_BASE messages to leak process memory addresses, defeating ASLR protections. Subsequently, the attacker transmits malicious GRAPH_COMPUTE messages containing tensor data with buffer field set to 0, exploiting the missing bounds validation in deserialize_tensor() to write a ROP chain or shellcode into process memory. This achieves arbitrary code execution with the privileges of the llama.cpp server process, enabling lateral movement, data exfiltration of LLM models or training data, or deployment of persistence mechanisms on the compromised host.