Description

llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in the vocab pointer of llama-server when the --sleep-idle-seconds feature is enabled, allowing unauthenticated remote attackers to execute arbitrary code. Attackers can trigger the vulnerability by sending requests to affected endpoints while the server transitions to sleep mode, causing concurrent worker threads to dereference a freed vocab pointer that can be reclaimed with attacker-controlled data to achieve remote code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-06T22:17:06.200Z",
  "pubdate": "2026-08-06T22:17:06.200Z",
  "executiveSummary": "A critical use-after-free vulnerability exists in llama.cpp builds b7492 through the latest b9060, specifically affecting the vocab pointer within llama-server when the --sleep-idle-seconds feature is enabled. This memory corruption flaw allows unauthenticated remote attackers to achieve remote code execution on affected systems.\nThe vulnerability is triggered during the server's transition state into sleep mode. When requests are transmitted to affected endpoints during this precise transition window, concurrent worker threads attempt to access and dereference a vocab pointer that has already been deallocated.\nSophisticated threat actors can exploit this race condition by executing heap grooming and memory reclamation techniques, replacing the freed memory block with attacker-controlled data. Successful exploitation leads to arbitrary code execution within the context of the running process, presenting a severe risk to confidentiality, integrity, and availability.\nThe attack requires network access to the exposed llama-server instance with the specified idle sleep feature enabled, but requires no prior authentication or administrative privileges, lowering the threshold for successful remote exploitation.",
  "technicalDetails": "The root cause of the vulnerability stems from improper synchronization and memory lifecycle management of the vocab pointer in llama-server. When the --sleep-idle-seconds configuration parameter is active, the server transitions into an idle sleep state after a designated period of inactivity, which involves releasing and freeing internal resources including the vocabulary structures.\nThe vulnerable component resides in the worker thread management and request handling logic of llama-server. Specifically, concurrent worker threads processing incoming network requests may attempt to access the vocab pointer concurrently with or immediately after the server's state machine initiates the sleep transition and deallocates the memory.\nThe affected versions comprise llama.cpp builds b7492 through the latest b9060. The vulnerability is network-exposed when llama-server is reachable by clients, requires no authentication, and demands no special privileges from the attacker.\nThe step-by-step attack flow proceeds as follows: First, the attacker identifies a running instance of llama-server where the --sleep-idle-seconds feature is enabled. Second, the attacker monitors or induces the server to approach its idle timeout threshold. Third, precisely as the server begins transitioning into sleep mode and deallocates the vocab pointer, the attacker floods the affected endpoints with crafted concurrent requests. Fourth, worker threads still active or spawned during the teardown phase attempt to dereference the now-freed vocab pointer. Fifth, the attacker leverages heap spraying or memory layout manipulation to reclaim the freed memory chunk with malicious payload data prior to the dereference operation. Finally, the execution flow is hijacked, allowing the attacker to execute arbitrary code with the privileges of the llama-server process."
}