Loading story…
A high-severity vulnerability tracked as CVE-2026-39909 affects ggml-org llama.cpp versions before b8585, exposing the project's RPC server to unauthenticated remote compromise. The flaw is a use-after-free bug in the GRAPH_RECOMPUTE handler, where stored computation graphs can be re-executed after their referenced buffers have already been freed, leaving dangling pointers in memory.
Security advisories say an attacker can free those buffers, reclaim the released memory with attacker-controlled content, and then trigger graph recomputation to gain arbitrary read and write access, ultimately leading to remote code execution. The issue is classified as CWE-416 and carries a CVSS v3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H; published references point to a fixing commit, a GitHub pull request, a release tag, and a VulnCheck advisory documenting the bug.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
VulnCheck published an advisory describing a use-after-free flaw in llama.cpp before version b8585 in the RPC server's GRAPH_RECOMPUTE handler. The advisory said unauthenticated remote attackers could achieve arbitrary read/write access and potentially remote code execution without user interaction.
The CVE record states that disclosure@vulncheck.com received the new CVE on Aug. 21, 2026. The issue was identified as a use-after-free vulnerability in llama.cpp's RPC GRAPH_RECOMPUTE handler affecting versions before b8585.
A GitHub pull request titled "Conversation fix: Branching logic + small refactor" was merged into ggml-org/llama.cpp master with merge commit 389c7d4. The CVE record later referenced this commit and pull request as related to CVE-2026-39909, though the pull request content itself did not describe the vulnerability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple high-severity vulnerabilities were disclosed in `ggml-org/llama.cpp`, including **CVE-2026-43622** and **CVE-2026-70638**, both affecting builds `b1886` through `b7445` and semver releases `0.9.0` through `0.17.1`. The flaws are concentrated in the **LLaMA-Android JNI wrapper** in `llama-android.cpp`: one issue stems from a `malloc()`/`delete` mismatch in `new_1batch()` and `free_1batch()`, causing a double free and heap metadata corruption, while the other arises from an unchecked integer multiplication involving `n_seq_max`, leading to insufficient heap allocation and possible heap corruption. Both bugs can crash Android applications using the binding and may enable arbitrary code execution depending on runtime conditions; patched release `b7446` is cited as the fix point. The disclosures were accompanied by a public patch repository from **Cyera Research**, which said it reported 10 `llama.cpp` vulnerabilities between 2025 and 2026, covering issues such as integer overflow, integer underflow, buffer overflow, use-after-free, unbounded task creation, and an Android JNI race condition. Cyera said earlier advisories and a patch pull request were closed without fixes being merged, after which **VulnCheck** assigned 10 CVE IDs, including replacement identifiers **CVE-2026-70638**, **CVE-2026-70639**, and **CVE-2026-70640**. The reported flaws carry CVSS scores ranging from **7.3** to **9.2**, underscoring ongoing supply-chain risk for developers embedding `llama.cpp` in Android and other AI-enabled applications.
Aug 7, 2026
**CVE-2026-22778** is a critical vulnerability in *vLLM* (an LLM inference/serving engine) that can enable **remote code execution (RCE)** when a server processes attacker-supplied multimodal content (e.g., a crafted video/image payload). The issue stems from vLLM returning a **PIL error** to the client when an invalid image is submitted to a multimodal endpoint, which **leaks a heap address** and dramatically weakens ASLR (reported as reducing brute-force from billions of guesses to ~8). This information disclosure can then be chained with a **heap overflow** in the **JPEG2000 decoder** within bundled **OpenCV/FFmpeg** components to hijack execution flow and run arbitrary commands on the host. Operational risk is elevated because many **default vLLM deployments** (including common `pip`/Docker installs) may be exposed without authentication, and reporting indicates exploitation may still be possible **pre-auth** even when API keys are enabled (via an “invocations” route). The vulnerability affects versions **0.8.3 through < 0.14.1** and is **fixed in vLLM 0.14.1**; remediation should prioritize upgrading to `>= 0.14.1` and reviewing exposure of multimodal endpoints, especially any internet-accessible instances.
Jul 12, 2026
FreeBSD disclosed **CVE-2026-4747** in advisory **`FreeBSD-SA-26:08.rpcsec_gss`**, warning that improper bounds checking in RPCSEC_GSS packet-signature validation can copy attacker-controlled data into a fixed stack buffer and trigger a stack overflow. The bug affects all supported FreeBSD versions and can be exploited by an unauthenticated client. In the kernel, exploitation is possible when **`kgssapi.ko`** is loaded and the system is running an NFS server with RPCSEC_GSS enabled; in userspace, RPC servers linked against **`librpcsec_gss`** are also exposed, although FreeBSD said it was not aware of vulnerable base-system applications in that category. Independent technical write-ups tied the flaw to **`svc_rpc_gss_validate`** in the RPC/NFS path, describing how a crafted **RPCSEC_GSS** credential length can overflow a 128-byte stack buffer and potentially corrupt saved control data, leading to denial of service or kernel-mode remote code execution. The reports said the issue is reachable over the network, commonly via NFS on **TCP port 2049**, and could result in full system compromise if exploited successfully. FreeBSD released patches for supported stable and release branches and said there is no practical workaround beyond avoiding deployments where **`kgssapi.ko`** is loaded.
Jun 29, 2026