CVE-2026-39909: llama.cpp RPC Server RCE Vulnerability

CVE-2026-39909 Overview

CVE-2026-39909 is a use-after-free vulnerability [CWE-416] in the llama.cpp Remote Procedure Call (RPC) server's GRAPH_RECOMPUTE handler. Versions of llama.cpp before build b8585 are affected. Unauthenticated remote attackers can achieve arbitrary read and write access by storing a computation graph, freeing referenced buffers, and reclaiming freed memory with attacker-controlled content. Subsequent RPC requests trigger re-execution of stored graphs containing dangling pointers, resulting in remote code execution without authentication or user interaction.

Critical Impact
Unauthenticated remote attackers can achieve arbitrary read/write primitives and full remote code execution against exposed llama.cpp RPC servers.

Affected Products

llama.cpp releases prior to build b8585
Deployments exposing the llama.cpp RPC server over the network
Downstream applications embedding vulnerable llama.cpp RPC components

Discovery Timeline

2026-08-21 - CVE-2026-39909 published to the National Vulnerability Database (NVD)
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-39909

Vulnerability Analysis

The vulnerability resides in the RPC server component of llama.cpp, which accepts serialized computation graphs from remote clients. The GRAPH_RECOMPUTE handler stores computation graphs on the server for later re-execution. It does not invalidate stored graph references when the buffers those graphs reference are freed. This mismatch between object lifetime and reference lifetime creates a use-after-free condition [CWE-416].

An attacker interacts with the server through three RPC steps. First, the attacker submits a computation graph that references specific buffer objects. Second, the attacker issues RPC calls that free those referenced buffers. Third, the attacker triggers allocations that reclaim the freed memory with attacker-controlled bytes. Invoking GRAPH_RECOMPUTE then re-executes the stored graph against dangling pointers now backed by attacker data.

Re-execution reads and writes through the reclaimed memory as if it were the original buffer. This yields arbitrary read and write primitives across the server process address space. Attackers chain these primitives into full remote code execution in the process running the RPC listener.

Root Cause

The root cause is missing lifetime tracking between stored graph structures and their referenced buffer allocations in the RPC server. Freeing a buffer does not remove or invalidate references held by previously stored graphs, so the graph continues to hold dangling pointers.

Attack Vector

Exploitation requires network access to the llama.cpp RPC endpoint. No authentication is required, and no user interaction is needed. An attacker with reachability to the RPC port sends a sequence of RPC messages that store a graph, free the referenced buffers, spray heap allocations with controlled content, and finally trigger GRAPH_RECOMPUTE.

The upstream fix landed in release b8585. Commit 389c7d4955ba55c7418afaebf7c23d9ed64ef707 and pull request #21175 are referenced in the advisory metadata. See the VulnCheck Advisory on llama.cpp and the GitHub Release b8585 for technical details.

Detection Methods for CVE-2026-39909

Indicators of Compromise

Inbound network connections to llama.cpp RPC listener ports from unexpected sources or geolocations.
Sequences of RPC operations that store a computation graph, free referenced buffers, then invoke GRAPH_RECOMPUTE within a short interval.
Unexpected child processes, shell invocations, or outbound connections originating from the llama.cpp RPC server process.
Crashes, segmentation faults, or abnormal memory-access errors logged by the RPC server.

Detection Strategies

Inspect RPC traffic patterns for repeated GRAPH_RECOMPUTE calls following buffer free operations against the same graph identifier.
Baseline expected RPC clients and alert on new or anonymous callers reaching the llama.cpp service.
Monitor process behavior of the RPC server for anomalies such as new file writes, privilege changes, or network egress inconsistent with inference workloads.

Monitoring Recommendations

Enable verbose logging in the llama.cpp RPC server and forward logs to a centralized analytics platform.
Deploy network segmentation and log all traffic to RPC ports for retrospective analysis.
Track versions of deployed llama.cpp binaries and alert on any instance below build b8585.

How to Mitigate CVE-2026-39909

Immediate Actions Required

Upgrade llama.cpp to release b8585 or later on every host that runs the RPC server.
Restrict network exposure of the llama.cpp RPC port to trusted management networks only; block it at the perimeter firewall.
Audit running instances of llama.cpp and identify any RPC listener reachable from untrusted networks.
Rotate any secrets, tokens, or model artifacts that resided on hosts running vulnerable RPC servers.

Patch Information

The vulnerability is fixed in llama.cpp build b8585. The upstream fix is tracked in GitHub Pull Request #21175 and the corresponding GitHub Commit Update. Downstream distributions and container images that bundle llama.cpp must be rebuilt against the patched release.

Workarounds

Disable the RPC server entirely if remote graph execution is not required by your deployment.
Bind the RPC listener to 127.0.0.1 or an internal interface only, and require an authenticated reverse proxy or VPN for access.
Apply host firewall rules restricting inbound access to the RPC port to a small allowlist of client IPs.

bash

# Configuration example: restrict llama.cpp RPC port (default 50052) with iptables
iptables -A INPUT -p tcp --dport 50052 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 50052 -j DROP

# Verify installed llama.cpp build
./llama-server --version   # ensure output reports b8585 or later