CVE-2026-43632 in llama.cpp
Summary
by MITRE • 08/07/2026
llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in llama-server affecting six tokenization endpoints (/tokenize, /detokenize, /infill, /apply-template, /rerank, and /anthropic/count_tokens) that bypass the task queue and access ctx_server.vocab directly on HTTP worker threads. Attackers can exploit a time-of-check-time-of-use race condition where the main thread destroys and frees vocab after the synchronization lock is released but before the handler finishes using it, causing a crash or potential code execution when --sleep-idle-seconds is configured.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability identified in llama.cpp versions b7492 through b9060 represents a critical use-after-free condition that manifests within the llama-server component when processing tokenization requests across six specific endpoints. This flaw occurs at the intersection of concurrent thread management and memory safety practices, where HTTP worker threads directly access the ctx_server.vocab structure without proper synchronization guarantees during the tokenization process. The affected endpoints include /tokenize, /detokenize, /infill, /apply-template, /rerank, and /anthropic/count_tokens, all of which bypass the standard task queue mechanism to directly interact with the vocabulary context.
The technical root cause stems from a time-of-check-time-of-use race condition that exploits the interaction between the main thread's memory management and HTTP worker threads. When the synchronization lock is released by the main thread, it proceeds to destroy and free the vocab structure while worker threads may still be in the process of accessing this same memory region. This timing discrepancy creates a window where worker threads attempt to dereference pointers to already-freed memory locations, resulting in undefined behavior that can manifest as immediate crashes or more insidiously, potential code execution exploits. The vulnerability is particularly dangerous when --sleep-idle-seconds parameter is configured, as this setting can prolong the window of opportunity for attackers to manipulate thread scheduling and memory access patterns.
The operational impact of this vulnerability extends beyond simple service disruption to potentially enable remote code execution in carefully crafted attack scenarios. Attackers who can control the timing of HTTP requests and have knowledge of the underlying memory layout may exploit this race condition to achieve arbitrary code execution on systems running vulnerable llama.cpp versions. The bypass of the task queue mechanism means that these endpoints operate outside normal request processing safeguards, making them particularly susceptible to concurrent access issues. This vulnerability directly maps to CWE-416 Use After Free and can be categorized under ATT&CK technique T1059 Command and Scripting Interpreter when exploited for code execution purposes.
Mitigation strategies should focus on implementing proper thread synchronization mechanisms around the vocab structure access, ensuring that memory deallocation only occurs after all worker threads have completed their operations. The recommended approach includes introducing additional locking primitives or reference counting mechanisms to prevent premature destruction of the vocab context. Security updates should enforce proper lifecycle management of shared resources and implement defensive programming practices such as null pointer checks and memory validation routines. Organizations should also consider implementing network segmentation controls and monitoring for unusual patterns in tokenization endpoint usage that might indicate exploitation attempts, particularly when --sleep-idle-seconds is configured in production environments.