8.1Yüksek
CVE-2026-107183llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser
Açıklama
llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling current_tool pointer. Attackers can submit a chat_parser in a POST /completion request emitting a tool-id after a tool-close tag to crash llama-server and shape a heap write primitive.
Zayıflık türü (CWE):
CWE-416
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
Kaynaklar ve yamalar
- https://github.com/ggml-org/llama.cpp/pull/29942 patchissue-tracking
- Patch Commit patch
- Dangling current_tool in common_chat_peg_mapper::map technical-description
- chat_parser accepted from request body technical-description
- https://github.com/ggml-org/llama.cpp product
- VulnCheck Advisory: llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser third-party-advisory