CVE-2026-17500: llama.cpp RCE Vulnerability

CVE-2026-17500 Overview

CVE-2026-17500 is a null pointer dereference vulnerability in ggml-org/llama.cpp, an open-source C/C++ inference engine for large language models. The flaw resides in the _visit_pattern function within common/json-schema-to-grammar.cpp and affects builds d006858 and e15efe0. An attacker can trigger the dereference remotely by supplying a crafted JSON schema, causing the process to crash. The issue is tracked under CWE-404: Improper Resource Shutdown or Release. A fix has been proposed but not yet merged at the time of publication.

Critical Impact
Remote attackers can crash llama.cpp inference services by submitting malformed JSON schemas, disrupting availability of LLM-based applications.

Affected Products

ggml-org llama.cpp build d006858
ggml-org llama.cpp build e15efe0
Any downstream application embedding the affected json-schema-to-grammar component

Discovery Timeline

2026-07-27 - CVE-2026-17500 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-17500

Vulnerability Analysis

The vulnerability exists in llama.cpp's JSON schema to grammar conversion logic. The _visit_pattern function in common/json-schema-to-grammar.cpp fails to validate a pointer before dereferencing it while parsing a regex pattern within a JSON schema. When the function encounters an unexpected structural element, it accesses a null pointer and the process terminates.

The function is reachable from any interface that accepts JSON schemas from a client, including HTTP endpoints exposed by the llama.cpp server for constrained generation. This creates a network-reachable denial-of-service condition without requiring authentication or user interaction.

Impact is limited to availability. Memory contents are not disclosed and no code execution is achievable through this flaw. Details are described in the GitHub issue tracker.

Root Cause

The root cause is missing input validation on regex pattern nodes traversed by _visit_pattern. The function assumes structural invariants that a caller-supplied schema can violate. When those invariants do not hold, the traversal returns a null pointer that is dereferenced downstream.

Attack Vector

The attack vector is network-based with low complexity and no privileges required. An attacker sends a crafted JSON schema to an exposed llama.cpp endpoint that invokes grammar conversion. Any endpoint using the json_schema or grammar-constrained generation feature is reachable. Successful requests crash the inference process. See the VulDB CVE record for additional metadata.

No verified public exploit code is available. The EPSS probability is 0.419% at the 34th percentile as of 2026-07-30.

Detection Methods for CVE-2026-17500

Indicators of Compromise

Unexpected termination or restart of llama.cpp server processes, particularly with SIGSEGV exit codes
Inbound HTTP requests to /completion, /v1/chat/completions, or similar endpoints containing malformed json_schema or grammar fields
Repeated client sessions producing crashes shortly after schema submission

Detection Strategies

Monitor process supervisors and container orchestrators for crash-loop conditions on llama.cpp workloads
Inspect application logs for stack traces referencing _visit_pattern or json-schema-to-grammar.cpp
Deploy request logging on inference endpoints and flag payloads containing atypical or deeply nested regex constructs in pattern fields

Monitoring Recommendations

Alert on abnormal request-to-crash ratios from individual source IP addresses targeting inference APIs
Track service availability metrics for LLM endpoints and correlate downtime with request payloads
Ingest inference server logs into a centralized analytics platform to enable pattern-based hunting across deployments

How to Mitigate CVE-2026-17500

Immediate Actions Required

Restrict network exposure of llama.cpp inference endpoints to trusted clients using firewall or reverse-proxy access controls
Disable JSON schema and grammar-constrained generation features if not required by the application
Add authentication and rate limiting in front of inference APIs to reduce anonymous abuse

Patch Information

A fix is proposed in GitHub Pull Request #25308 and awaits maintainer acceptance. Track the upstream repository for the merged commit and rebuild llama.cpp from a version that includes the fix once available.

Workarounds

Validate and sanitize client-supplied JSON schemas at the application layer before forwarding them to llama.cpp
Reject requests containing regex pattern fields until a patched build is deployed
Run inference workloads under a process supervisor that automatically restarts on crash to preserve service continuity while the patch is pending

bash

# Example: block schema/grammar fields at an nginx reverse proxy
location /completion {
    if ($request_body ~* "(json_schema|grammar)") {
        return 400;
    }
    proxy_pass http://llama_backend;
}