CVE-2026-43631

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-43631
llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in the vocab pointer of llama-server when the --sleep-idle-seconds feature is enabled, allowing unauthenticated remote attackers to execute arbitrary code. Attackers can trigger the vulnerability by sending requests to affected endpoints while the server transitions to sleep mode, causing concurrent worker threads to dereference a freed vocab pointer that can be reclaimed with attacker-controlled data to achieve remote code execution.

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/Vladimir-tokarev-cyera/llama-cpp-security-patches Patch Third Party Advisory
https://www.vulncheck.com/advisories/llama-cpp-b7492-b9060-use-after-free-rce-via-llama-server Patch Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:ggml:llama.cpp:*:*:*:*:*:*:*:*
History

23 Oct 2026, 21:10

Type Values Removed Values Added
Summary
  • (es) Las compilaciones b7492 hasta la última b9060 de llama.cpp contienen una vulnerabilidad de uso después de liberación en el puntero vocab de llama-server cuando la característica --sleep-idle-seconds está habilitada, lo que permite a atacantes remotos no autenticados ejecutar código arbitrario. Los atacantes pueden activar la vulnerabilidad enviando solicitudes a los puntos finales afectados mientras el servidor transiciona al modo de suspensión, lo que provoca que los hilos de trabajo concurrentes desreferencien un puntero vocab liberado que puede ser reclamado con datos controlados por el atacante para lograr la ejecución remota de código.

21 Sep 2026, 18:11

Type Values Removed Values Added
CPE cpe:2.3:a:ggml:llama.cpp:*:*:*:*:*:*:*:*
References () https://github.com/Vladimir-tokarev-cyera/llama-cpp-security-patches - () https://github.com/Vladimir-tokarev-cyera/llama-cpp-security-patches - Patch, Third Party Advisory
References () https://www.vulncheck.com/advisories/llama-cpp-b7492-b9060-use-after-free-rce-via-llama-server - () https://www.vulncheck.com/advisories/llama-cpp-b7492-b9060-use-after-free-rce-via-llama-server - Patch, Third Party Advisory
First Time Ggml
Ggml llama.cpp
Information

Published : 2026-08-06 22:17

Updated : 2026-10-23 21:10

NVD link : CVE-2026-43631

Mitre link : CVE-2026-43631

CVE.ORG link : CVE-2026-43631

JSON object : View

Products Affected

ggml

  • llama.cpp
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CWE-416

Use After Free