CVE-2026-107183

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-107183", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-07T13:04:03.727Z", "datePublished": "2026-10-07T13:35:41.675Z", "dateUpdated": "2026-10-07T14:37:12.658Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-07T13:35:41.675Z"}, "datePublic": "2026-10-04T00:00:00.000Z", "title": "llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser", "descriptions": [{"lang": "en", "value": "llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling current_tool pointer. Attackers can submit a chat_parser in a POST /completion request emitting a tool-id after a tool-close tag to crash llama-server and shape a heap write primitive."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Use After Free", "cweId": "CWE-416", "type": "CWE"}]}], "affected": [{"vendor": "ggml-org", "product": "llama.cpp", "defaultStatus": "unaffected", "packageURL": "pkg:github/ggml-org/llama.cpp", "versions": [{"version": "b8227", "status": "affected", "versionType": "custom", "lessThan": "b11393"}, {"version": "b11393", "status": "unaffected", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:ggml:llama.cpp:*:*:*:*:*:*:*:*", "versionStartIncluding": "b8227", "versionEndExcluding": "b11393"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 9.2, "baseSeverity": "CRITICAL"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/ggml-org/llama.cpp/pull/29942", "tags": ["patch", "issue-tracking"]}, {"url": "https://github.com/ggml-org/llama.cpp/commit/dbe4c3ed42343f0a7ba0fd7e808ffeaca404d29f", "tags": ["patch"], "name": "Patch Commit"}, {"url": "https://github.com/ggml-org/llama.cpp/blob/bed0a856606ee4a24a164066f73d2379447033f5/common/chat-peg-parser.cpp#L343-L355", "name": "Dangling current_tool in common_chat_peg_mapper::map", "tags": ["technical-description"]}, {"url": "https://github.com/ggml-org/llama.cpp/blob/bed0a856606ee4a24a164066f73d2379447033f5/tools/server/server-schema.cpp#L321-L324", "name": "chat_parser accepted from request body", "tags": ["technical-description"]}, {"url": "https://github.com/ggml-org/llama.cpp", "tags": ["product"]}, {"name": "VulnCheck Advisory: llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/llama-cpp-before-b11393-use-after-free-via-common-chat-peg-mapper-chat-parser"}], "credits": [{"lang": "en", "value": "Anas", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-07T14:36:59.882876Z", "id": "CVE-2026-107183", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T14:37:12.658Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-107183", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-07T13:04:03.727Z", "datePublished": "2026-10-07T13:35:41.675Z", "dateUpdated": "2026-10-07T14:37:12.658Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-07T13:35:41.675Z"}, "datePublic": "2026-10-04T00:00:00.000Z", "title": "llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser", "descriptions": [{"lang": "en", "value": "llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling current_tool pointer. Attackers can submit a chat_parser in a POST /completion request emitting a tool-id after a tool-close tag to crash llama-server and shape a heap write primitive."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Use After Free", "cweId": "CWE-416", "type": "CWE"}]}], "affected": [{"vendor": "ggml-org", "product": "llama.cpp", "defaultStatus": "unaffected", "packageURL": "pkg:github/ggml-org/llama.cpp", "versions": [{"version": "b8227", "status": "affected", "versionType": "custom", "lessThan": "b11393"}, {"version": "b11393", "status": "unaffected", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:ggml:llama.cpp:*:*:*:*:*:*:*:*", "versionStartIncluding": "b8227", "versionEndExcluding": "b11393"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 9.2, "baseSeverity": "CRITICAL"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/ggml-org/llama.cpp/pull/29942", "tags": ["patch", "issue-tracking"]}, {"url": "https://github.com/ggml-org/llama.cpp/commit/dbe4c3ed42343f0a7ba0fd7e808ffeaca404d29f", "tags": ["patch"], "name": "Patch Commit"}, {"url": "https://github.com/ggml-org/llama.cpp/blob/bed0a856606ee4a24a164066f73d2379447033f5/common/chat-peg-parser.cpp#L343-L355", "name": "Dangling current_tool in common_chat_peg_mapper::map", "tags": ["technical-description"]}, {"url": "https://github.com/ggml-org/llama.cpp/blob/bed0a856606ee4a24a164066f73d2379447033f5/tools/server/server-schema.cpp#L321-L324", "name": "chat_parser accepted from request body", "tags": ["technical-description"]}, {"url": "https://github.com/ggml-org/llama.cpp", "tags": ["product"]}, {"name": "VulnCheck Advisory: llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/llama-cpp-before-b11393-use-after-free-via-common-chat-peg-mapper-chat-parser"}], "credits": [{"lang": "en", "value": "Anas", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-107183", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-07T14:36:59.882876Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T14:37:05.670Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/ggml-org/llama.cpp", "product": "llama.cpp", "vendor": "ggml-org", "versions": [{"lessThan": "b11393", "status": "affected", "version": "b8227", "versionType": "custom"}, {"status": "unaffected", "version": "b11393", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling current_tool pointer. Attackers can submit a chat_parser in a POST /completion request emitting a tool-id after a tool-close tag to crash llama-server and shape a heap write primitive."}], "id": "CVE-2026-107183", "lastModified": "2026-10-07T15:57:20.793", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.2, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-107183", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-07T14:36:59.882876Z", "version": "2.0.3"}}]}, "published": "2026-10-07T14:17:09.003", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/ggml-org/llama.cpp"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/ggml-org/llama.cpp/blob/bed0a856606ee4a24a164066f73d2379447033f5/common/chat-peg-parser.cpp#L343-L355"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/ggml-org/llama.cpp/blob/bed0a856606ee4a24a164066f73d2379447033f5/tools/server/server-schema.cpp#L321-L324"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/ggml-org/llama.cpp/commit/dbe4c3ed42343f0a7ba0fd7e808ffeaca404d29f"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/ggml-org/llama.cpp/pull/29942"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/llama-cpp-before-b11393-use-after-free-via-common-chat-peg-mapper-chat-parser"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "llama.cpp: llama.cpp: Arbitrary code execution via crafted completion request", "id": "2547441", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547441"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["A flaw was found in llama.cpp. An unauthenticated remote attacker could exploit this vulnerability by submitting a specially crafted completion request with malformed chat parser parameters. Due to improper memory handling, this request triggers a use-after-free condition that corrupts memory. This flaw can potentially lead to arbitrary code execution or cause a Denial of Service (DoS) by crashing the server."], "mitigation": {"lang": "en:us", "value": "Restrict network exposure of the llama-server service to trusted network segments or localhost using firewall rules or reverse proxy controls.\n1. Restrict access to the service port using firewalld:\nfirewall-cmd --permanent --zone=public --remove-port=8080/tcp\nfirewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_IP_RANGE>\nfirewall-cmd --reload\nAlternatively, configure the server daemon to bind exclusively to the localhost interface (127.0.0.1) if remote connectivity is not required.\nCaveats: Limiting network reachability prevents untrusted remote clients from sending completion requests, which will impact external integrations and client applications that rely on remote API access.\nWarning: Reloading firewall rules or restarting the service daemon will terminate active network connections and interrupt ongoing inference jobs."}, "name": "CVE-2026-107183", "public_date": "2026-10-07T13:35:41Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-107183\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-107183\nhttps://github.com/ggml-org/llama.cpp\nhttps://github.com/ggml-org/llama.cpp/blob/bed0a856606ee4a24a164066f73d2379447033f5/common/chat-peg-parser.cpp#L343-L355\nhttps://github.com/ggml-org/llama.cpp/blob/bed0a856606ee4a24a164066f73d2379447033f5/tools/server/server-schema.cpp#L321-L324\nhttps://github.com/ggml-org/llama.cpp/commit/dbe4c3ed42343f0a7ba0fd7e808ffeaca404d29f\nhttps://github.com/ggml-org/llama.cpp/pull/29942\nhttps://www.vulncheck.com/advisories/llama-cpp-before-b11393-use-after-free-via-common-chat-peg-mapper-chat-parser"], "statement": "Red Hat has rated this vulnerability as Critical because unauthenticated remote attackers can cause memory corruption without requiring prior privileges or user interaction. When the inference service processes untrusted HTTP completion requests, malformed chat parser payloads can cause an application crash or enable arbitrary code execution within the host environment. Deployments that run the component strictly in offline batch modes or isolate API endpoints from untrusted network traffic experience significantly reduced risk.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[b8227,b11393)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "b11393"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "llama.cpp", "source": "cna", "vendor": "ggml-org"}, "product": "llama.cpp", "vendor": "ggml"}], "created": "2026-10-07T16:00:11.081469+00:00", "updated": "2026-10-07T16:15:18.425839+00:00", "vendors": ["ggml", "ggml$PRODUCT$llama.cpp"]}