CVE-2026-39909

llama.cpp before b8585 contains a use-after-free vulnerability in the RPC server's GRAPHRECOMPUTE handler that allows unauthenticated remote attackers to achieve arbitrary read and write access by storing a computation graph, freeing referenced buffers, and reclaiming freed memory with...