The vulnerability is a use‑after‑free in the llama.cpp RPC server. An attacker can store a computation graph, free its buffers, then send another request that forces the server to re‑execute the freed graph. The dangling pointer allows the attacker to inject arbitrary data into freed memory, giving them the ability to read and modify arbitrary memory on the host, ultimately enabling full remote code execution without any authentication or user interaction.

The affected product is ggml-org llama.cpp prior to release b8585. Any deployment that hosts the RPC interface and runs a version earlier than b8585 is vulnerable. The issue resides in the GRAPH_RECOMPUTE handler of the RPC server code.

The CVSS score of 9.2 indicates a very high severity. Because the vulnerability can be triggered via an unauthenticated RPC request, the attack surface is wide and attackers need only network connectivity to the RPC endpoint. The EPSS score is currently unavailable, but the lack of a KEV listing does not reduce the risk. Attackers can gain arbitrary read/write and thus remote code execution simply by sending crafted RPC requests; no further privileges or user interaction are required.