External risk intelligence

llama.cpp RPC Backend Arbitrary Memory Read Write Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-34159

The vulnerability exists in the RPC backend of llama.cpp. While the RPC server is designed for distributed computing and can be network-accessible, it is typically deployed within controlled, internal cluster environments or research labs rather than exposed directly to the public internet as a primary edge service.

Memory Corruption

Ggml Llama Cpp

before b8492

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in llama.cpp, a C/C++ implementation for running large language models, allows unauthenticated attackers with network access to a specific RPC port to read and write arbitrary process memory. This could potentially lead to full control over the affected system. The issue has been addressed in newer versions.

Unauthenticated attackers can control the system.
Critical for systems running large language models.
Confirm relevance and exposure of affected systems.

Attack Path

How an attacker could exploit the issue

An attacker could gain unauthorized access to a running llama.cpp service exposed to a network. By sending specially crafted messages, they could trick the service into processing invalid tensor data, allowing them to read and write arbitrary memory within the service's process. This could lead to bypassing security measures like ASLR and ultimately executing arbitrary code on the system.

No authentication required.
Crafted GRAPH_COMPUTE messages.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in llama.cpp's RPC backend could allow an unauthenticated attacker with network access to read and write arbitrary process memory. This could lead to a full bypass of memory protection mechanisms and potentially remote code execution.

Arbitrary process memory.
Crafted RPC messages over the network.
Full control of the affected process.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in llama.cpp's RPC backend, allowing arbitrary memory read/write and remote code execution, requires immediate attention from teams managing the inference backend. The first practical step is to inventory all instances of llama.cpp, verify network exposure of the RPC port, and identify the owning team for remediation planning.

Ownership: Platform or inference teams.
Verify: RPC server network exposure.
Action: Plan remediation during maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is llama.cpp?

llama.cpp is a software library written in C/C++ designed to run Large Language Models (LLMs) locally on hardware. It provides an inference engine that allows users to perform computations with these models, and it includes an RPC (Remote Procedure Call) backend to facilitate distributed computing tasks across different machines.

What is the vulnerability in CVE-2026-34159?

This vulnerability is an instance of CWE-119, a memory safety issue. In the affected versions, the RPC backend fails to check the bounds of data when processing specific tensor requests. This allows an attacker to manipulate the memory of the running process, effectively bypassing protections that normally keep the program's data secure.

How can an attacker trigger this memory issue?

An attacker triggers this by sending specially crafted GRAPH_COMPUTE messages to the RPC server port. Simply connecting to the service is sufficient, as no authentication is required. Note that this bug is specific to the RPC backend; it is not triggered by standard local LLM operations that do not utilize these specific network-based tensor commands.

Do I need to worry if my llama.cpp instance is internal?

Halo Surface Signal indicates that while the RPC server is meant for distributed computing, it is often found in internal clusters or labs. You should assess if your service is reachable from untrusted network segments. Even if it is not directly on the public internet, any unauthorized actor with network access to the RPC port could leverage this flaw.

How do I secure my systems against this CVE?

The primary response is to update your software to version b8492 or later, which includes the necessary bounds validation to prevent this memory access. Before patching, inventory your infrastructure to locate all running instances, confirm which ones have the RPC backend enabled, and ensure network access to those specific ports is restricted to authorized users.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.