CVE-2026-43632 ggml-org CVE debrief

Who should care

Developers and administrators using llama.cpp versions b7492 through b9060 should be aware of this critical vulnerability and take immediate action to protect their systems. They should review and apply vendor patches, implement compensating controls, and monitor for suspicious activity. Additionally, they should inventory and verify the llama.cpp version in use and configure --sleep-idle-seconds with caution.

Technical summary

CVE-2026-43632 is a critical use-after-free vulnerability in llama.cpp, affecting versions b7492 through b9060. The vulnerability is located in the llama-server and impacts six tokenization endpoints: /tokenize, /detokenize, /infill, /apply-template, /rerank, and /anthropic/count_tokens. These endpoints bypass the task queue and directly access ctx_server.vocab on HTTP worker threads. An attacker can exploit a time-of-check-time-of-use race condition, where the main thread destroys and frees vocab after releasing the synchronization lock but before the handler finishes using it. This can lead to a crash or potential code execution when the --sleep-idle-seconds configuration is used.

Defensive priority

Critical vulnerability in llama.cpp, with CVSS score of 9.2, affecting multiple tokenization endpoints.

Recommended defensive actions

• Review and apply vendor patches for llama.cpp b7492 through b9060.
• Implement compensating controls to restrict access to affected tokenization endpoints.
• Monitor for suspicious activity on HTTP worker threads.
• Inventory and verify the llama.cpp version in use.
• Configure --sleep-idle-seconds with caution.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE-2026-43632 vulnerability is a use-after-free issue in llama-server affecting six tokenization endpoints. Attackers can exploit a time-of-check-time-of-use race condition to cause a crash or potential code execution. The main thread destroys and frees vocab after releasing the synchronization lock but before the handler finishes using it. This issue affects llama.cpp versions b7492 through b9060. Developers should verify the llama.cpp version in use and review vendor patches. The vulnerability has a CVSS score of 9.2 and is considered critical.

Official resources