CVE-2026-39909 in llama.cpp
Summary
by MITRE • 08/21/2026
llama.cpp before b8585 contains a use-after-free vulnerability in the RPC server's GRAPH_RECOMPUTE handler that allows unauthenticated remote attackers to achieve arbitrary read and write access by storing a computation graph, freeing referenced buffers, and reclaiming freed memory with attacker-controlled content. Attackers can send RPC requests to trigger re-execution of stored graphs with dangling pointers, enabling full remote code execution without requiring authentication or user interaction.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified in llama.cpp prior to commit b8585 represents a critical security flaw within the Remote Procedure Call server implementation, specifically targeting the GRAPH_RECOMPUTE handler. This issue is classified as a use-after-free error, which occurs when software continues to use memory that has been freed by another part of the program. In this specific context, the vulnerability arises from an improper management of computational graph resources during re-execution cycles. The flaw allows unauthenticated remote attackers to achieve arbitrary read and write access on the target system. This capability is particularly dangerous as it bypasses authentication mechanisms entirely, requiring no user interaction or social engineering tactics to exploit.
The technical mechanism behind this vulnerability involves a sequence of operations that manipulate memory allocation and deallocation states within the RPC server. An attacker begins by sending an RPC request to store a computation graph on the target system. This action allocates specific buffers in memory to hold the state and data associated with the computational tasks defined in the graph. Subsequently, the attacker triggers a re-execution of this stored graph via another RPC call. During this process, the application frees the referenced buffers that were previously allocated for the initial execution phase. However, due to the flaw in the GRAPH_RECOMPUTE handler, references to these now-freed memory locations are retained and still utilized during subsequent operations.
The core of the exploitation lies in the ability of an attacker to reclaim the freed memory with content under their control before it is reallocated for legitimate purposes or garbage collection. By carefully timing their requests, attackers can ensure that new allocations map to the same physical memory addresses as the previously freed buffers. When the system attempts to execute the recomputed graph using dangling pointers that reference these reclaimed blocks, it effectively reads from and writes to attacker-controlled data structures rather than intended application memory. This misalignment between logical references and actual memory locations constitutes a classic use-after-free scenario, leading to undefined behavior that can be precisely controlled by the adversary.
The operational impact of this vulnerability is severe, culminating in full remote code execution without authentication. Because the attacker gains arbitrary read capabilities, they can exfiltrate sensitive data such as model weights, user inputs, or internal system states from the memory space of the llama.cpp process. More critically, the ability to perform arbitrary writes allows for precise manipulation of program control flow. By overwriting function pointers, return addresses, or other critical metadata in memory, an attacker can redirect execution to shellcode injected into the reclaimed buffers. This results in complete compromise of the host system running the vulnerable version of llama.cpp, potentially leading to further lateral movement within a network if the service is exposed externally.
From a classification perspective, this vulnerability aligns with CWE-416, which describes use-after-free conditions where memory is accessed after it has been freed. The exploitation technique also maps closely to MITRE ATT&CK techniques related to remote code execution and privilege escalation through memory corruption. Specifically, the method of controlling program flow via overwritten pointers corresponds to Tactic 12: Defense Evasion or Tactic 7: Command and Control depending on the specific payload delivered, but fundamentally it enables initial access as described in Tactic 6: Credential Access if used for data theft, though primarily it facilitates Initial Access through unauthenticated remote exploitation.
Mitigation strategies must focus immediately on updating llama.cpp to version b8585 or later, where this memory management flaw has been addressed by the developers. For environments where immediate patching is not feasible, network-level controls should be implemented to restrict access to the RPC server interface. This includes restricting connectivity to trusted IP addresses only and disabling the GRAPH_RECOMPUTE functionality if it is not strictly required for operational workflows. Additionally, deploying intrusion detection systems that monitor for anomalous memory allocation patterns or unusual RPC traffic volumes can provide early warning of exploitation attempts. Regular security audits focusing on C++ codebases are essential to identify similar use-after-free vulnerabilities in other components of the software stack.