EUVD-2026-94330
GHSA-3g9g-qh2j-c5q8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach network-exposed llama-server
-
DeliverySend crafted POST /completion chat_parser
-
ExploitEmit tool-id after tool-close tag
-
ExecutionTrigger use-after-free on current_tool
-
PersistGroom heap into write primitive
-
ImpactCrash server or execute code
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a running llama-server with its HTTP /completion endpoint reachable by the attacker and tool-calling/chat parsing in use, since the flaw is triggered by a chat_parser that emits a tool-id token after a tool-close tag. No authentication or user interaction is needed (PR:N/UI:N), and llama-server ships without authentication by default, so any network-exposed instance is at risk. The main limiting factor is reliability, not access: crashing the server (DoS) is straightforward, but turning the use-after-free into a controlled heap write primitive requires heap grooming, reflected in AC:H. Upgrading to b11393 or applying the current_tool = nullptr fix removes the dangling-pointer condition. |
| Impact | This is a genuine high-priority issue rather than a CVSS-inflated one. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 9.2) agrees with the description: a network-reachable, unauthenticated POST to /completion triggers a CWE-416 use-after-free/double-free via a dangling current_tool pointer, and the vendor itself frames the outcome as both a crash (DoS) and a shaped heap write primitive (potential code execution). The one tempering signal is AC:H - reliably converting the UAF into a controlled heap write requires heap grooming, so trivial exploitation yields a crash while weaponization for RCE is harder. No EPSS score was provided and there is no CISA KEV entry, so active exploitation is NOT indicated; equally, no public POC is referenced - the GitHub links are the upstream patch/commit and the vulnerable source lines, not working exploit code. Note the discrepancy worth verifying: the description asserts a heap write primitive (implying integrity/code-execution impact) but the only CONFIRMED runtime effect is a server crash, so the VI:H/VC:H rating reflects claimed potential rather than demonstrated RCE. The finder is VulnCheck (credible), and a vendor patch exists, which raises the practical urgency of patching any internet- or network-exposed llama-server. |
| Exploit ScenarioDerived | An attacker who can reach a network-exposed llama-server sends a crafted POST /completion request whose chat_parser emits a tool-id token immediately after a tool-close tag, causing common_chat_peg_mapper::map to reuse a freed current_tool pointer. This at minimum crashes the server (denial of service) and, with heap grooming, can be shaped into a controlled heap write for potential remote code execution. No public exploit is referenced, though the upstream patch and vulnerable source lines are published, lowering the bar for exploit development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Heap memory corruption in llama.cpp's chat/tool parser lets unauthenticated remote attackers crash llama-server and potentially shape a controlled heap write primitive by sending a crafted POST /completion request containing a chat_parser that emits a tool-id token after a tool-close tag. Versions prior to build b11393 are affected; the trigger leaves the mapper's current_tool pointer dangling, producing a use-after-free and double-free in common_chat_peg_mapper::map. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV, but the CVSS 4.0 score of 9.2 reflects high confidentiality, integrity and availability impact, and the independent assessment confirms high severity (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) - reliable denial of service is straightforward, while converting the bug into a controlled heap write requires heap grooming. A vendor patch exists as upstream PR/commit and as build b11393.
RemediationAI
Vendor-released patch: upgrade to llama.cpp build b11393 or later, which incorporates PR 29942 (commit dbe4c3ed42343f0a7ba0fd7e808ffeaca404d29f); the change simply nulls the current_tool pointer after a tool-close event, removing the dangling reference, so backporting that single line to a pinned older build is a viable option for distributions that cannot move to b11393. Until the upgrade is deployed, restrict exposure of llama-server: bind it to loopback or an internal interface instead of 0.0.0.0, require the built-in API key (--api-key) or front it with an authenticating reverse proxy, and firewall the /completion endpoint so only trusted clients reach it - the trade-off is that these controls only reduce reachability of the memory-corruption path and break any client that currently talks to the unauthenticated default configuration. If tool calling is not required, disabling tool/chat-parser handling for untrusted callers (rejecting requests that supply a chat_parser or tool schema, or disabling the --jinja chat-template/tool path) removes the attack trigger at the cost of losing structured tool-call output; detection should focus on POST /completion bodies that place a tool-id after a tool-close tag and on llama-server crashes or heap-abort messages, since no public exploit code was identified at time of analysis but the endpoint is trivially reachable on any default deployment.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is a classic CWE-416 use-after-free (with a double-free consequence) in llama.cpp's PEG-based chat parser. llama-server parses chat templates and tool-call syntax using common_chat_peg_mapper, which walks a PEG (parsing expression grammar) AST and tracks the currently open tool call in a raw pointer, current_tool (common/chat-peg-parser.cpp, referenced lines ~343-355). When a chat_parser supplied in the request emits a tool-id after the tool-close tag, the mapper operates on a tool context that has already been released, leaving current_tool dangling; the subsequent dereference/free path corrupts heap metadata and can yield an out-of-bounds write primitive. The server-schema code that builds the request schema (tools/server/server-schema.cpp, lines ~321-324) is what makes attacker-controlled parser definitions reachable through the HTTP API, so the vulnerable surface is exposed by the server's request-schema handling rather than by the model itself. The upstream fix (PR 29942, commit dbe4c3ed42343f0a7ba0fd7e808ffeaca404d29f) is a one-line hardening change that sets current_tool = nullptr after a tool closes, eliminating the stale pointer; the CVSS 4.0 vector supplied with the CVE (AV:N/AC:H/PR:N/UI:N/VC:H/VI:H/VA:H) is broadly consistent with the independently assessed CVSS 3.1 vector apart from score inflation, and neither vector attributes impact to other components (S:U / SC:SI:SA:N).
Know when Llama Cpp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Unauthenticated network request to /completion gives AV:N/PR:N/UI:N; reliable heap-write exploitation needs grooming so AC:H; crash plus potential code execution supports C/I/A:H with unchanged scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling current_tool pointer. Attackers can submit a chat_parser in a POST /completion request emitting a tool-id after a tool-close tag to crash llama-server and shape a heap write primitive.
Executive ViewAI
Llama.cpp deployments running llama-server are exposed to a critical heap memory corruption flaw that can be triggered by unauthenticated remote requests, allowing attackers to crash the service and potentially influence memory contents. No public exploit identified at time of analysis, but the flaw carries high confidentiality, integrity, and availability risk. Leadership should prioritize patching because these AI inference services may support critical business workflows and sensitive data.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Arbitrary memory write in llama.cpp's RPC server allows remote unauthenticated attackers to corrupt arbitrary memory add
Remote code execution in llama.cpp (commit 18c2e17) is possible when a user opens a malicious .gguf model file, triggeri
Llama.cpp server endpoints fail to validate the n_discard parameter from JSON input, allowing negative values that trigg
Remote code execution in llama.cpp (commit 18c2e17) is possible when a victim loads a malicious .gguf model file, trigge
Remote code execution in llama.cpp (GGUF library) allows attackers to achieve arbitrary code execution by tricking a use
Remote code execution in llama.cpp (commit 18c2e17) occurs when the GGUF library's gguf_fread_str function parses a mali
Heap-based buffer overflow in llama.cpp's GGUF library header parser (commit 18c2e17) enables code execution when a vict
CVE-2025-52566 is a signed vs. unsigned integer overflow vulnerability in llama.cpp's tokenizer (llama_vocab::tokenize f
Remote code execution in llama.cpp RPC backend allows unauthenticated attackers with TCP access to achieve arbitrary mem
llama.cpp provides LLM inference in C/C++. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable,
Heap buffer overflow in llama.cpp's server KV cache state-restore path (builds b4882 through b9058) lets an attacker who
Remote code execution in llama.cpp's llama-server (builds b7492 through b9060) allows unauthenticated attackers to run a
Exploit-DB