vladimir-tokarev-cyera/llama-cpp-security-patchesSecurity patches for unpatched llama.cpp vulnerabilities (CVE-2026-43626 through CVE-2026-43632) — Cyera Research
Security patches for unpatched vulnerabilities in llama.cpp, discovered by Cyera Research.
Between July 2025 and June 2026, we reported 10 vulnerabilities to the llama.cpp project through GitHub Security Advisories and MITRE. All advisories were closed by the maintainer without fixes or CVE assignment. We submitted a public PR with patches in June 2026 — it was also closed without merging.
VulnCheck allocated 10 CVE IDs after both the vendor and MITRE failed to act. Three of the original IDs (CVE-2026-43623, CVE-2026-43624, CVE-2026-43626) were subsequently replaced by CVE-2026-70638, CVE-2026-70639, and CVE-2026-70640 respectively.
These patches are provided so that users and downstream projects can protect themselves.
| CVE | CVSS | Vulnerability | Affected File(s) | Patch |
|---|
| CVE-2026-70640 | 7.3 | Android JNI race condition (UAF) | ai_chat.cpp | CVE-2026-70640 |
| CVE-2026-43627 | 8.5 | llama_batch_init() integer overflow | llama-batch.cpp | CVE-2026-43627 |
| CVE-2026-43628 | 8.5 | DRY sampler integer underflow | llama-sampler.cpp, arg.cpp, server-task.cpp | CVE-2026-43628 |
| CVE-2026-43629 | 9.2 | KV cache state buffer overflow | llama-kv-cache.cpp | CVE-2026-43629 |
| CVE-2026-43631 | 9.2 | Server sleep-idle use-after-free | server-context.cpp, server-queue.cpp, server-queue.h | CVE-2026-43631 |
| CVE-2026-43632 | 9.2 | Server unbounded task creation | server-task.cpp, server-queue.cpp | CVE-2026-43632 |
Apply a single fix:
cd /path/to/llama.cpp
git apply /path/to/patches/CVE-2026-43631-server-sleep-uaf.patch
Apply all fixes at once:
cd /path/to/llama.cpp
git apply /path/to/patches/all-fixes.patch
If git apply fails due to context changes in newer llama.cpp versions, try with --3way:
git apply --3way /path/to/patches/all-fixes.patch
| Date | Event |
|---|---|
| July 2025 | First vulnerability submitted via GitHub Security Advisory |
| October 2025 | Contacted MITRE for CVE assignment — 7 request IDs received, none assigned |
| January–May 2026 | Four more advisories submitted — all closed without fixes |
| May 2026 | VulnCheck allocated 10 CVEs |
| June 2026 | Public PR with patches submitted — PR closed |