llama.cpp EUVD-2026-54287

Exploitation requires that llama-server be started with the --sleep-idle-seconds option enabled - this is the specific configuration that triggers main-thread destruction and freeing of ctx_server.vocab and is NOT a default setting. The attacker must send requests to one of the six vulnerable tokenization endpoints (/tokenize, /detokenize, /infill, /apply-template, /rerank, or /anthropic/count_tokens) and win a Time-of-Check-Time-of-Use race, hitting the window after the synchronization lock is released but before the handler finishes using vocab, precisely as the idle timer frees it. Limiting factors: the race is timing-dependent and difficult to win reliably (reflected in CVSS AC:H and AT:P), the server must be network-reachable, and non-idle-sleep deployments are not exploitable at all. No authentication (PR:N) or user interaction (UI:N) is required against a vulnerable instance.

The signals are mixed and should be read together. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) yields 9.2 driven by network reach, no authentication, and high CIA impact, but the AC:H and AT:P metrics explicitly encode that exploitation requires winning a narrow timing race and meeting an environmental precondition - this is not a trivially reliable exploit. There is no EPSS score, no CISA KEV listing, and no confirmed public proof-of-concept in the provided data, so there is no evidence of active or automatable exploitation; the RCE tag reflects worst-case potential, not demonstrated code execution. Critically, the vulnerability is gated on the non-default --sleep-idle-seconds option, so most deployments are not exposed. Realistic outcome is a remotely triggerable crash (denial of service); the 'potential code execution' claim is plausible for a heap use-after-free but not independently demonstrated. Net: treat as a genuine high-severity issue for internet-exposed llama-server instances running idle-sleep, but a lower operational priority for default configurations.

An attacker who can reach an internet-exposed llama-server started with --sleep-idle-seconds sends a high volume of rapid requests to a tokenization endpoint such as /tokenize while timing them to coincide with the idle-teardown window. If a request is being processed on a worker thread at the moment the main thread frees vocab, the handler dereferences freed memory, crashing the server or, in the worst case, corrupting heap state toward code execution. No authentication or user interaction is required, but success depends on winning the timing race, and no public proof-of-concept is currently known.