CVE-2026-107183 in llama.cpp
Summary
by MITRE • 10/07/2026
llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling current_tool pointer. Attackers can submit a chat_parser in a POST /completion request emitting a tool-id after a tool-close tag to crash llama-server and shape a heap write primitive.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in versions of llama.cpp prior to commit b11393 represents a critical memory safety flaw located within the common_chat_peg_mapper::map function, which is responsible for parsing chat completion requests. This component processes structured inputs submitted by clients via HTTP POST requests to the /completion endpoint. The core technical deficiency involves improper management of pointer lifecycles during the processing of tool-related tags in the input stream. Specifically, when a client submits a chat parser payload that includes a tool-id emitted after a tool-close tag, the application fails to correctly invalidate or nullify references to previously allocated memory objects associated with those tools. This oversight leads directly to use-after-free and double free conditions, where the system attempts to access or deallocate memory regions that have already been released back to the heap allocator.
From an operational perspective, this flaw allows unauthenticated remote attackers to interact with the llama-server instance without requiring any form of authentication credentials. By crafting a maliciously formatted POST request containing specific sequences of tool tags and identifiers, an attacker can trigger the dangling pointer dereference. The immediate consequence is often a segmentation fault or application crash, resulting in a denial-of-service condition for legitimate users relying on the inference service. However, the severity extends far beyond simple availability disruption. Because the vulnerability corrupts heap memory structures during the deallocation process, it provides an attacker with significant control over memory layout and content. This capability effectively shapes a heap write primitive, which is a foundational building block for more sophisticated exploitation techniques such as arbitrary code execution or privilege escalation within the context of the running server process.
The technical nature of this vulnerability aligns closely with CWE-416, Use After Free, where software continues to use a pointer after it has been freed, and CWE-415, Double Free, which occurs when an application calls free on a memory block that is already freed. In the context of modern attack frameworks, this flaw facilitates exploitation paths consistent with ATT&CK technique T1068, Exploitation for Privilege Escalation, as heap corruption can be leveraged to overwrite function pointers or virtual table entries within C++ objects. The lack of authentication requirements further exacerbates the risk profile, placing it in a high-severity category comparable to CWE-94, Improper Control of Generation of Code (Code Injection), when considering the potential for remote code execution through heap spraying and exploitation techniques targeting modern memory protection mechanisms like ASLR and DEP.
Mitigation strategies must prioritize immediate software updates to version b11393 or later, where these pointer management issues have been addressed by developers implementing stricter lifecycle checks and ensuring that dangling pointers are properly nullified after deallocation events. For environments where patching is not immediately feasible, network-level controls should be implemented to restrict access to the /completion endpoint exclusively to trusted IP addresses or through an authenticated API gateway layer. Additionally, deploying runtime application self-protection (RASP) solutions or memory sanitizers during testing phases can help detect such heap corruption anomalies before they reach production environments. It is also advisable to enforce strict input validation on chat parser payloads to reject malformed sequences of tool tags that do not adhere to expected state machine transitions, thereby reducing the attack surface available for triggering these specific memory safety violations.