llama.cpp patches remotely exploitable use-after-free in llama-server RPC endpoint

ggml

Tools official 1 src. ~1 min

llama.cpp release b11000 (Sep 16) fixes a use-after-free in cached RPC graphs that could leak libc addresses and hijack a vtable, giving potential remote code execution against llama-server RPC deployments. The same day's builds also add CUDA graph support for MTP draft models and K-Quant kernels for the Qualcomm Hexagon backend.

Why it matters

llama-server RPC is commonly exposed on LANs for multi-node inference; the vulnerability is remotely triggerable rather than a local-only crash, so deployments should update.

Importance: 2/5

Remotely exploitable security fix in widely deployed inference server

llama-cpp local-llm security inference

Sources

official Releases - ggml-org/llama.cpp