CVE-2026-39909: llama.cpp Use-After-Free in RPC GRAPH_RECOMPUTE Handler
llama.cpp before b8585 contains a use-after-free vulnerability in the RPC server's GRAPHRECOMPUTE handler that allows unauthenticated remote attackers to achieve arbitrary read and write access by storing a computation graph, freeing referenced buffers, and reclaiming freed memory with attacker-controlled content. Attackers can send RPC requests to trigger re-execution of stored graphs with dangling pointers, enabling full remote code execution without requiring authentication or user interaction.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
llama.cppto a version that resolves this vulnerability.Fixed in b8585 - Compensating control
If you cannot immediately upgrade llama.cpp to a version where the GRAPH_RECOMPUTE handler use-after-free is fixed, restrict network access to the llama.cpp RPC server so unauthenticated attackers cannot send RPC requests that trigger GRAPH_RECOMPUTE re-execution (e.g., allow only trusted IPs over the RPC port).
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments running an affected llama.cpp version with its RPC server reachable by an attacker are exposed. The vulnerable handler is part of the RPC server, so systems not offering that service are not described as affected by this attack path.
Does exploitation require credentials or user interaction?
No. The issue is exploitable by an unauthenticated remote attacker and requires no user interaction.
What capabilities does an attacker need to exploit the flaw?
An attacker needs to send RPC requests that store a computation graph, free buffers referenced by that graph, reclaim the freed memory with attacker-controlled content, and then trigger graph re-execution through GRAPH_RECOMPUTE. Successful exploitation can provide arbitrary read and write access and lead to remote code execution.
What version resolves the issue?
The vulnerability affects llama.cpp versions before b8585. Updating to b8585 or later addresses the affected version range described here.