External risk intelligence

llama.cpp RPC Server Use-After-Free Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-39909

The vulnerability affects an RPC server component in llama.cpp. While RPC services can be exposed to the internet, they are frequently deployed within internal or restricted networks for distributed computing tasks. Public exposure is possible depending on the specific implementation and deployment architecture, but it is not a standard, inherently internet-facing gateway or web application.

Use After Free

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in llama.cpp's RPC server, specifically within its computation graph handling. Exploitation could allow unauthenticated remote attackers to gain arbitrary read and write access to systems, potentially leading to full remote code execution without user interaction. The main concern is confirming relevance and exposure within our environments.

A critical flaw allows remote code execution.
It affects llama.cpp's RPC server component.
Confirm if this technology is in use.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted requests to the RPC server. This triggers a flaw where memory is freed but still referenced, allowing the attacker to overwrite that memory with malicious data. By doing so, the attacker can gain control of the application, leading to arbitrary data access and modification.

Unauthenticated remote access required.
Triggered by RPC GRAPH_RECOMPUTE handler.
Allows arbitrary read/write access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated remote attackers to execute arbitrary code on affected systems. This is possible when the RPC server's GRAPH_RECOMPUTE handler is triggered, leading to memory corruption and subsequent code execution.

System data could be compromised.
Attackers trigger graph re-execution.
Full remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in llama.cpp's RPC server requires identifying which teams manage its deployment and ensuring the affected service is not exposed externally. The first practical step is to locate all instances of this technology, confirm their reachability and business criticality, and then assign an owner to plan remediation based on the identified risk.

Application or platform teams own the issue.
Verify RPC server exposure and business criticality.
Plan remediation based on risk and impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is llama.cpp and why do developers use it?

llama.cpp is a popular software library designed to enable efficient large language model inference on a wide variety of hardware. Developers use it to run AI models locally or in distributed environments by optimizing computational performance. The RPC server component mentioned in this advisory is a specific part of the software that allows these heavy computational tasks to be distributed across different machines in a network.

How does CVE-2026-39909 create a security risk?

This vulnerability is classified as a use-after-free weakness (CWE-416). In plain terms, the RPC server keeps a reference to a memory location even after that memory has been freed. An attacker can manipulate this by replacing that freed memory with their own data. When the server later uses that 'dangling' pointer to perform a computation, it processes the attacker's data instead, potentially leading to unauthorized read/write access or execution of malicious code.

What specific action triggers this vulnerability?

The flaw is triggered specifically through the GRAPH_RECOMPUTE handler in the RPC server. An attacker must send a specially crafted RPC request that tells the server to re-execute a computation graph using memory that has already been deallocated. It is important to note that sending standard, non-malicious RPC traffic or interacting with parts of the software unrelated to this specific handler will not trigger the bug.

Is my system at risk if I use llama.cpp?

According to Halo Surface Signal, risk depends on how you have deployed your RPC services. While some configurations might be exposed to the internet, these services are frequently placed within restricted internal networks for distributed computing. You are most concerned if your instance is reachable from untrusted networks; however, you should still inventory your environment to confirm where this component is active, regardless of its current network placement.

What is the recommended first step to address this?

The immediate priority is to locate all instances of llama.cpp across your infrastructure to identify which teams are responsible for their deployment. Once identified, verify whether the RPC server functionality is active and assess its network reachability. Once you understand the business context and exposure level, you can coordinate with the owners to plan a patch or configuration change to mitigate the risk.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.