llama.cpp patches an unauthenticated RPC use-after-free that yields remote code execution, five months after the private advisory

GitHub·high signalXBlueskyLinkedInCopy link

PR #24292, merged 2026-09-16, fixes a use-after-free in llama.cpp's RPC server: the per-device cached compute graph holds raw pointers into backend buffers, and a client-issued FREE_BUFFER followed by GRAPH_RECOMPUTE re-executes the graph through dangling pointers. The PR states the bug is reachable by an unauthenticated remote client and is sufficient to leak libc addresses and hijack the buffer iface vtable used by BUFFER_CLEAR, giving RCE. It was reported privately as GHSA-2phh-px2f-2qmx on 2026-04-30 and only now submitted publicly; the fix tracks which buffers each cached graph references and drops the cache in free_buffer().