Loading vulnerability…
CVE-2026-34159 affects llama.cpp versions prior to b8492. The flaw is in the RPC backend's deserialize_tensor() function, which skips bounds validation when a tensor's buffer field is set to 0. By sending crafted GRAPH_COMPUTE messages to the exposed RPC server, an unauthenticated attacker can trigger arbitrary process memory reads and writes. The available context further indicates that pointer disclosure primitives via ALLOC_BUFFER and BUFFER_GET_BASE can be combined with this memory corruption condition to bypass ASLR and achieve remote code execution.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).
This repository is a compact exploit repo containing a short README and one Python exploit script, linux_exploit_llama.py. It is a real exploit, not a detector. The script targets CVE-2026-34159 in the llama.cpp RPC server, specifically version/build b8487 on Linux. The exploit is network-based and interacts directly with the server's custom RPC protocol over a TCP socket. The Python script implements an end-to-end exploitation chain. It connects to the RPC service, performs the HELLO handshake, allocates a remote buffer, obtains the buffer base, and abuses tensor/buffer operations to achieve arbitrary read/write. From there it leaks a function pointer from the ggml backend buffer interface, scans memory backward to locate the ELF base of libggml-base.so, reads the GOT entry for memcpy to derive a libc leak, then scans backward again to identify libc base and extract the GNU Build-ID. The script comments indicate it uses libc.rip to resolve the correct system() offset automatically from the Build-ID, although the visible code also includes hardcoded offsets verified against the author's environment. For code execution, the exploit writes a bash reverse shell command plus a resolved system() pointer into attacker-controlled memory, then uses the arbitrary write primitive to corrupt function pointers in the remote ggml_backend_buffer interface. Specifically, it overwrites the interface so that a later BUFFER_CLEAR RPC command results in a call to system("bash -c ..."). The final effect is unauthenticated remote code execution with a reverse shell callback to the attacker. Repository structure is minimal: README.md identifies the CVE and links to an external write-up; linux_exploit_llama.py is the sole operational entry point and contains the exploit logic, protocol constants, socket communications, memory corruption primitives, leak logic, and payload trigger path. The exploit is operational but somewhat environment-dependent because it relies on Linux/glibc behavior and offsets validated against a specific build.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.