llama.cpp: Use-after-free and double free in chat parser
Summary
llama.cpp builds before b11393 contain a use-after-free and double free vulnerability in the chat output parser (common_chat_peg_mapper::map). A remote attacker can send a crafted chat_parser request to the llama-server POST /completion endpoint without authentication, which can crash the server and may corrupt heap memory. Code execution has not been demonstrated, and no exploitation in the wild is known.
Affected
- llama.cpp builds from b8227 up to, but not including, b11393
- Affected component: llama-server (/completion endpoint) and the chat parser
- Downstream packages and containers that bundle llama.cpp must be checked separately
Fixed in
- Upgrade to llama.cpp b11393 or later
- Fix commit: dbe4c3e
- Verify the commit or build number of the binary actually in use
Workaround
- No official workaround found.
- Restrict network access to llama-server and do not expose the /completion endpoint to untrusted networks until patched.
- Require authentication at a reverse proxy in front of llama-server (own recommendation, not a vendor statement).
Exploitation
- Not known to be exploited in the wild; not listed in CISA KEV as far as checked.
- EPSS about 0.4%.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No standalone public exploit found.
Our recommendation
- Inventory all llama.cpp and llama-server instances, including containers and bundled applications.
- Upgrade to b11393 or later and verify the running binary.
- Until patched, restrict access to the server and require authentication at a proxy.
- Monitor the upstream repository and NVD for updates.
- Check the separate llama.cpp use-after-free CVE-2026-43631 for builds b7492 to b9060.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- Fix pull request #29942 github.com
- Fix commit dbe4c3e github.com
- llama.cpp release b11393 github.com
- Ubuntu security notice ubuntu.com
- SUSE CVE via Vulners vulners.com
- Debian security tracker security-tracker.debian.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:48.
Original description (NVD)
llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling current_tool pointer. Attackers can submit a chat_parser in a POST /completion request emitting a tool-id after a tool-close tag to crash llama-server and shape a heap write primitive.
NVD references (6)
- https://github.com/ggml-org/llama.cpp
- https://github.com/ggml-org/llama.cpp/blob/bed0a856606ee4a24a164066f73d2379447033f5/common/chat-peg-parser.cp…
- https://github.com/ggml-org/llama.cpp/blob/bed0a856606ee4a24a164066f73d2379447033f5/tools/server/server-schem…
- https://github.com/ggml-org/llama.cpp/commit/dbe4c3ed42343f0a7ba0fd7e808ffeaca404d29f
- https://github.com/ggml-org/llama.cpp/pull/29942
- https://www.vulncheck.com/advisories/llama-cpp-before-b11393-use-after-free-via-common-chat-peg-mapper-chat-p…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.