Description

llama.cpp before b8585 contains a use-after-free vulnerability in the RPC server's GRAPH_RECOMPUTE handler that allows unauthenticated remote attackers to achieve arbitrary read and write access by storing a computation graph, freeing referenced buffers, and reclaiming freed memory with attacker-controlled content. Attackers can send RPC requests to trigger re-execution of stored graphs with dangling pointers, enabling full remote code execution without requiring authentication or user interaction.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-21T17:16:30.810Z",
  "pubdate": "2026-08-21T17:16:30.810Z",
  "executiveSummary": "A use-after-free vulnerability exists in llama.cpp before b8585 within the RPC server's GRAPH_RECOMPUTE handler. This flaw allows unauthenticated remote attackers to achieve arbitrary read and write access to system memory.\nThe vulnerability impacts the llama.cpp RPC server component, posing severe risk implications by potentially enabling full remote code execution without requiring any authentication or user interaction.\nAttackers can leverage network exposure to send malicious RPC requests, storing computation graphs, freeing referenced buffers, and subsequently reclaiming the freed memory with attacker-controlled content to exploit dangling pointers during graph re-execution.",
  "technicalDetails": "The root cause of the vulnerability resides in improper memory management within the RPC server's GRAPH_RECOMPUTE handler of llama.cpp before b8585. Specifically, the component fails to properly manage references to memory buffers associated with computation graphs.\nThe affected component is the RPC server, specifically the GRAPH_RECOMPUTE handler, which processes remote computation graph execution requests over the network without requiring authentication or privileges.\nThe exploitation method relies on a classic use-after-free pattern. First, an unauthenticated remote attacker stores a computation graph via the RPC interface. Second, the attacker triggers actions that free the memory buffers referenced by the stored graph, leaving dangling pointers pointing to the deallocated memory regions.\nThird, the attacker sends subsequent RPC payloads designed to reclaim the newly freed memory locations with attacker-controlled content (heap feng-shui). Finally, the attacker triggers the GRAPH_RECOMPUTE handler to re-execute the stored computation graph.\nBecause the graph references dangling pointers that now point to attacker-controlled data, the re-execution resolves to manipulated memory addresses. This enables the attacker to achieve arbitrary read and write capabilities within the context of the running application.\nThe post-exploitation impact includes full remote code execution on the host running the vulnerable llama.cpp RPC server, entirely bypassing authentication and user interaction requirements."
}