The vulnerability is a use‑after‑free error located in the llama‑server used by llama.cpp between builds b7492 and b9060. A time‑of‑check/time‑of‑use race allows the main thread to delete the vocabulary shared by the server while an HTTP worker thread is still processing a request, which can cause a crash or, if the coroutine is scheduled to run idle operations, may lead to arbitrary code execution.

The affected product is llama.cpp from the ggml‑org project. All builds between b7492 and the latest b9060 are impacted, and the flaw is present in six tokenization endpoints: /tokenize, /detokenize, /infill, /apply-template, /rerank, and /anthropic/count_tokens.

The risk is quantified by a CVSS score of 9.2, indicating high severity. The EPSS score of 0.0033 (< 1%) suggests a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, so there is no evidence of active exploitation. Attackers can remotely trigger the flaw by issuing HTTP requests to any of the six endpoints while the server is configured with --sleep-idle-seconds, enabling the main thread to free the vocabulary during the request’s processing. This race can result in a service denial or, in certain conditions, local code execution on the host.