CVE-2026-43632: llama.cpp from b7492 (inclusive), through b9060 (inclusive), b7492 through b9060

Affected technology

llama.cpp · from b7492 (inclusive), through b9060 (inclusive)
ggml

llama.cpp · b7492 through b9060
ggml-org

Description’s affected range: through the latest b9060

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Attackers can exploit a time-of-check-time-of-use race condition where the main thread destroys and frees vocab after the synchronization lock is released but before the handler finishes using it, causing a crash or potential code execution when --sleep-idle-seconds is configured. Vendor/CNA’s CVSS 4.0 assessment (base score 9.2/10) rates confidentiality, integrity and availability impact as high.