CVE-2026-39909 ggml-org CVE debrief

Who should care

Organizations and individuals using llama.cpp, especially those exposing the RPC server to untrusted networks or users, should prioritize patching to prevent potential remote code execution. This includes reviewing current deployments, assessing exposure, and ensuring that appropriate security measures are in place to protect against this vulnerability.

Technical summary

CVE-2026-39909 is a use-after-free vulnerability in the RPC server's GRAPH_RECOMPUTE handler of llama.cpp before version b8585. This vulnerability allows unauthenticated remote attackers to achieve arbitrary read and write access by storing a computation graph, freeing referenced buffers, and reclaiming freed memory with attacker-controlled content. Attackers can send RPC requests to trigger re-execution of stored graphs with dangling pointers, enabling full remote code execution without requiring authentication or user interaction.

Defensive priority

Organizations using llama.cpp should prioritize patching to prevent potential remote code execution.

Recommended defensive actions

• Apply the patch from https://github.com/ggml-org/llama.cpp/releases/tag/b8585
• Restrict access to the RPC server to trusted parties
• Monitor for suspicious RPC requests
• Inventory llama.cpp installations for version b8585 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE-2026-39909 record indicates a use-after-free vulnerability in llama.cpp before version b8585. The vulnerability is in the RPC server's GRAPH_RECOMPUTE handler, allowing unauthenticated remote attackers to achieve arbitrary read and write access. Limited information is available about the specific conditions and vectors. To verify, defenders should review the official advisory, assess their exposure, and monitor for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.