A use‑after‑free flaw in the vocabulary pointer of llama‑server causes fetch requests to a running daemon to dereference freed memory once the server enters sleep mode via the --sleep‑idle‑seconds option. An unauthenticated network attacker can trigger the flaw by sending requests to affected endpoints; the concurrent worker threads then access attacker‑controlled data that replaces the freed pointer, resulting in arbitrary code execution on the host. The weakness is directly linked to CWE‑416, CWE‑362, and involves CWE‑825.

The vulnerability affects the ggml‑org llama.cpp project in builds between commits b7492 and b9060. No specific release versions are enumerated in the advisory; the issue applies to any software compiled from the commit range that enables the sleep‑idle feature.

The CVSS score of 9.2 marks this as a critical flaw with high exploitation potential. EPSS score is 0.00412 (< 1%) and the issue is not listed in CISA KEV, but the lack of authentication requirement and the ability to exploit through normal HTTP endpoints make it highly practical. Attackers only need to point a request to a llama‑server instance running the vulnerable build with --sleep‑idle‑seconds enabled; no additional privileges or local access are required.