Which versions of llama.cpp are affected by EUVD-2026-54286?

A critical vulnerability in llama.cpp's llama-server (builds b7492-b9060) can allow unauthenticated remote attackers to gain unauthorized control over affected systems; no public exploit identified…

How to fix or mitigate EUVD-2026-54286?

Within 24 hours, identify all llama.cpp llama-server instances in production and determine which builds (b7492-b9060) are deployed and whether the --sleep-idle-seconds feature is enabled. Within 7 days, disable the --sleep-idle-seconds parameter on all affected instances and implement network segmentation to restrict access to llama-server ports to authorized internal systems only. Within 30 days, monitor vendor advisories for a patched version and plan upgrades to builds post-b9060 when available; establish a process to prevent re-enablement of the idle-sleep feature except where architecturally necessary and isolated.

llama.cpp EUVD-2026-54286

Q: What is the CVSS score of EUVD-2026-54286?

EUVD-2026-54286 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-43631 CRITICAL

Race Condition (CWE-362)

2026-08-06 disclosure@vulncheck.com

GHSA-6hc7-9rph-cm99

RCE Race Condition

9.2

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Unauthenticated network RCE (PR:N/UI:N, C/I/A:H) but AC:H because success depends on winning the sleep-transition race; same-process worker corruption means S:U.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.1 HIGH

qualitative

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 23:02 vuln.today

CVE Published

Aug 06, 2026 - 22:17 cve.org

CRITICAL 9.2

DescriptionCVE.org

llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in the vocab pointer of llama-server when the --sleep-idle-seconds feature is enabled, allowing unauthenticated remote attackers to execute arbitrary code. Attackers can trigger the vulnerability by sending requests to affected endpoints while the server transitions to sleep mode, causing concurrent worker threads to dereference a freed vocab pointer that can be reclaimed with attacker-controlled data to achieve remote code execution.

AnalysisAI

Remote code execution in llama.cpp's llama-server (builds b7492 through b9060) allows unauthenticated attackers to run arbitrary code by racing the server's idle-sleep transition when the --sleep-idle-seconds feature is enabled. Concurrent worker threads dereference a freed vocab pointer that can be reclaimed with attacker-controlled data. No public exploit identified at time of analysis, and the flaw is not in CISA KEV; exploitation is gated by a non-default configuration and a tight timing window (CVSS 4.0 base 9.2, AT:P/AC:H).

Technical ContextAI

llama.cpp is a widely used C/C++ inference engine for running GGUF large language models locally; llama-server is its HTTP serving front-end that exposes completion/embedding endpoints and dispatches requests across worker threads. The root cause is CWE-362 (race condition / improper synchronization of a shared resource): the vocab object owned by the model context is freed as part of the --sleep-idle-seconds idle-unload path, while in-flight worker threads still hold and dereference the now-dangling vocab pointer. This is a classic use-after-free reached through a time-of-check/time-of-use gap between the sleep-transition teardown and concurrent request handling. No CPE strings were supplied in the input, so exact affected configurations are drawn from the description's build-number range rather than an NVD CPE match.

RemediationAI

No vendor-released patched build version is confirmed in the provided data; the only fix pointer is a third-party GitHub security-patches repository (https://github.com/Vladimir-tokarev-cyera/llama-cpp-security-patches), so an upstream fix may exist but a released patched build is not independently confirmed - verify against the official ggml-org/llama.cpp releases before relying on a specific build. As an immediate and highly effective compensating control, disable the idle-sleep feature by not passing --sleep-idle-seconds (or setting it so the server never unloads), which removes the vulnerable teardown path entirely at the cost of higher steady-state memory/GPU usage since the model stays resident. Additionally, do not expose llama-server directly to untrusted networks: bind to localhost and place it behind an authenticating reverse proxy or restrict the listening port via firewall to trusted clients, which reduces reachability but does not fix the underlying race. Upgrade to an official patched build as soon as ggml-org confirms one.