PT-2026-29570 · Llama.Cpp · Llama.Cpp

Las7 · Published 2026-04-01 · Updated 2026-06-01 · CVE-2026-34159

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions llama.cpp versions prior to b8492

Description A logic bug in the RPC backend's deserialize tensor() function allows an unauthenticated attacker to read and write arbitrary process memory. This occurs because bounds validation is skipped when a tensor's buffer field is set to 0. By sending crafted 'GRAPH COMPUTE' messages and utilizing pointer leaks from 'ALLOC BUFFER' and 'BUFFER GET BASE', an attacker can achieve a full ASLR (Address Space Layout Randomization) bypass and remote code execution. The attack requires only TCP access to the RPC server port and no authentication.

Recommendations Update to version b8492.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2026-34159

Affected Products

Llama.Cpp

References · 24

• https://github.com/ggml-org/llama.cpp/pull/20908 · Patch
• https://github.com/ggml-org/llama.cpp/security/advisories/GHSA-j8rj-fmpv-wcxw · Vendor Advisory
• https://github.com/ggml-org/llama.cpp/commit/39bf0d3c6a95803e0f41aaba069ffbee26721042 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-34159 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-34159 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34159 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-34159 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34159 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34159 · Vendor Advisory
• https://twitter.com/lyrie_ai/status/2054075649992560972 · Twitter Post
• https://twitter.com/HugoValters/status/2050801601388961898 · Twitter Post
• https://twitter.com/TheHackerWire/status/2039615477111279652 · Twitter Post
• https://twitter.com/CveFindCom/status/2039670511882362894 · Twitter Post
• https://twitter.com/casp3r0x0/status/2047622881635385662 · Twitter Post
• https://twitter.com/xfeylesof/status/2048307198263009518 · Twitter Post