Description
llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling current_tool pointer. Attackers can submit a chat_parser in a POST /completion request emitting a tool-id after a tool-close tag to crash llama-server and shape a heap write primitive.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ggml-org | llama.cpp | b8227 – < b11393 | b11393 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | llama.cpp | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | llama.cpp | No fix yet | — |
| Ubuntu 26.04 LTS | llama.cpp | No fix yet | — |
References
- https://github.com/ggml-org/llama.cpp/pull/29942 patch issue-tracking
- Patch Commit patch
- Dangling current_tool in common_chat_peg_mapper::map technical-description
- chat_parser accepted from request body technical-description
- https://github.com/ggml-org/llama.cpp product
- VulnCheck Advisory: llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser third-party-advisory