llama.cpp llama-server: use-after-free on the vocab pointer during idle sleep gives unauthenticated RCE

CVE-2026-43631AI/ML frameworks & servingcurated

Impact

An unauthenticated caller who can reach the inference endpoint can race a request against the server's transition into idle sleep, causing worker threads to dereference a freed vocab pointer that can be reclaimed with attacker-controlled data. The advisory states this reaches arbitrary code execution in the llama-server process. On a GPU node that means code running with whatever identity the serving process holds - typically with the GPU devices already mapped in and, in a Kubernetes deployment, with the pod's service-account token and any mounted model or credential volumes. Idle-sleep is exactly the feature operators enable on shared or bursty inference fleets, so the vulnerable window recurs on every quiet period.

Who can reach it

Anyone who can send HTTP requests to llama-server. No authentication is required, and llama-server has no auth of its own by default - so exposure is whatever the network policy in front of the pod or the host allows. Only builds with --sleep-idle-seconds enabled are affected.

What to do

The record covers builds b7492 through b9060 and does not name a fixed build, so do not assume the latest tag is safe without checking the upstream advisory. The immediate mitigation is to stop passing --sleep-idle-seconds and restart llama-server, which closes the race without a node drain; the process restart drops in-flight sessions and re-warms the model into VRAM. Also confirm the endpoint is not reachable from tenant networks.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-43631 https://www.vulncheck.com/advisories/llama-cpp-b7492-b9060-use-after-free-rce-via-llama-server https://github.com/Vladimir-tokarev-cyera/llama-cpp-security-patches

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.