CVE-2026-34159 - Vulnerability Analysis

Overview

llama.cpp prior to version b8492 contains a remote code execution caused by lack of bounds validation in deserialize_tensor() in the RPC backend, letting unauthenticated attackers read/write arbitrary process memory remotely via crafted GRAPH_COMPUTE messages, exploit requires TCP access to RPC server port.

Severity & Score

Impact

Unauthenticated attackers can achieve full remote code execution and ASLR bypass, leading to complete system compromise.

Mitigation

Update to version b8492 or later.

References

• https://github.com/ggml-org/llama.cpp/commit/39bf0d3c6a95803e0f41aaba069ffbee26721042
• https://github.com/ggml-org/llama.cpp/pull/20908
• https://github.com/ggml-org/llama.cpp/security/advisories/GHSA-j8rj-fmpv-wcxw

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner