A use-after-free vulnerability in the llama.cpp RPC handler presents a critical risk of memory corruption and potential system compromise.

The vulnerability is a use-after-free (CWE-416) condition within the RPC graph recompute handler. It is exploitable by an unauthenticated attacker over the network, though it requires specific conditions to trigger successfully.

The use-after-free flaw allows for memory corruption, which can be leveraged to crash the service or potentially execute arbitrary code. With a CVSS score of 8.1, this vulnerability poses a high risk to systems running llama.cpp in networked environments, potentially leading to total loss of system integrity.

Immediate Action: Update llama.cpp to build b8585 or later to resolve the memory management defect.

Proactive Monitoring: Monitor system logs for unexpected service crashes or segmentation faults, which may indicate attempted exploitation of memory management flaws.

Compensating Controls: Isolate llama.cpp instances within restricted network segments and employ memory protection features, such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP), to mitigate the impact of memory corruption.

Public Exploit Available: Unknown

Organizations utilizing llama.cpp must update to build b8585 immediately to address the use-after-free vulnerability. Due to the potential for remote code execution, this update should be treated as a high priority task to prevent unauthorized system access or service disruption.