CVE-2026-43632

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-43632
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-43632.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-43632
Downstream
Published
2026-08-06T15:53:19Z
Modified
2026-09-23T03:47:26Z
Severity
  • 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
llama.cpp b7492–b9060 Use-After-Free in Tokenization Endpoints
Details

llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in llama-server affecting six tokenization endpoints (/tokenize, /detokenize, /infill, /apply-template, /rerank, and /anthropic/count_tokens) that bypass the task queue and access ctx_server.vocab directly on HTTP worker threads. Attackers can exploit a time-of-check-time-of-use race condition where the main thread destroys and frees vocab after the synchronization lock is released but before the handler finishes using it, causing a crash or potential code execution when --sleep-idle-seconds is configured.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-367",
        "CWE-416"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43632.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "b7492"
                },
                {
                    "last_affected":  "b9060"
                }
            ],
            "source":  "AFFECTED_FIELD"
        },
        {
            "extracted_events":  [
                {
                    "introduced":  "b7492"
                },
                {
                    "last_affected":  "b9060"
                }
            ],
            "source":  "CPE_FIELD"
        },
        {
            "extracted_events":  [
                {
                    "introduced":  "b7492"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}
References

Affected packages

Git / github.com/ggml-org/llama.cpp

Affected ranges

Type
GIT
Repo
https://github.com/ggml-org/llama.cpp
Events
Introduced
ddcb75dd8ac42dc23eb84f13bb17670fe9f2d49b
Last Affected
ad092246587b16299291056a78bf6f73f636f114
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:ggml:llama.cpp:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "b7492"
        },
        {
            "last_affected":  "b9060"
        }
    ],
    "source":  "CPE_RANGE"
}

Affected versions

Other
b7492
b7493
b7495
b7496
b7497
b7498
b7499
b7501
b7502
b7503
b7506
b7507
b7508
b7509
b7510
b7511
b7512
b7513
b7515
b7516
b7519
b7520
b7522
b7524
b7525
b7526
b7527
b7529
b7530
b7531
b7536
b7538
b7539
b7540
b7541
b7542
b7543
b7544
b7545
b7547
b7548
b7549
b7550
b7551
b7552
b7553
b7554
b7555
b7556
b7557
b7558
b7560
b7561
b7562
b7563
b7564
b7565
b7566
b7567
b7568
b7569
b7571
b7572
b7574
b7577
b7579
b7580
b7581
b7582
b7583
b7585
b7588
b7589
b7590
b7591
b7592
b7593
b7595
b7598
b7599
b7600
b7601
b7603
b7605
b7607
b7608
b7609
b7610
b7611
b7612
b7613
b7614
b7615
b7616
b7617
b7618
b7619
b7620
b7621
b7622
b7623
b7624
b7625
b7626
b7628
b7630
b7631
b7632
b7633
b7634
b7635
b7636
b7638
b7639
b7640
b7641
b7642
b7644
b7645
b7646
b7647
b7648
b7649
b7650
b7651
b7652
b7653
b7654
b7655
b7656
b7657
b7658
b7662
b7664
b7666
b7667
b7668
b7672
b7673
b7675
b7676
b7677
b7678
b7679
b7680
b7681
b7682
b7684
b7685
b7687
b7688
b7689
b7690
b7691
b7692
b7694
b7697
b7698
b7699
b7700
b7703
b7704
b7705
b7707
b7708
b7709
b7710
b7712
b7713
b7714
b7716
b7717
b7718
b7719
b7720
b7721
b7723
b7725
b7726
b7727
b7728
b7729
b7730
b7731
b7735
b7736
b7737
b7738
b7739
b7740
b7741
b7742
b7743
b7744
b7745
b7746
b7747
b7748
b7749
b7750
b7751
b7752
b7753
b7754
b7755
b7756
b7757
b7758
b7760
b7761
b7762
b7765
b7766
b7767
b7768
b7769
b7770
b7772
b7774
b7775
b7777
b7779
b7781
b7782
b7783
b7784
b7785
b7786
b7787
b7788
b7789
b7790
b7791
b7792
b7793
b7794
b7795
b7798
b7801
b7802
b7804
b7805
b7806
b7807
b7808
b7809
b7811
b7812
b7813
b7814
b7815
b7818
b7819
b7820
b7821
b7822
b7823
b7824
b7825
b7826
b7827
b7828
b7830
b7832
b7833
b7835
b7836
b7837
b7839
b7841
b7842
b7843
b7844
b7845
b7847
b7849
b7850
b7851
b7852
b7853
b7855
b7856
b7857
b7858
b7860
b7861
b7862
b7864
b7865
b7867
b7868
b7869
b7870
b7871
b7872
b7875
b7876
b7879
b7880
b7881
b7883
b7885
b7895
b7896
b7897
b7898
b7899
b7902
b7903
b7904
b7905
b7907
b7909
b7910
b7911
b7913
b7917
b7918
b7919
b7920
b7921
b7922
b7923
b7924
b7925
b7926
b7927
b7928
b7929
b7930
b7931
b7932
b7933
b7935
b7936
b7938
b7940
b7941
b7942
b7943
b7944
b7945
b7946
b7947
b7950
b7951
b7952
b7954
b7955
b7956
b7957
b7958
b7959
b7960
b7961
b7962
b7964
b7965
b7966
b7968
b7969
b7970
b7971
b7972
b7973
b7974
b7976
b7981
b7982
b7983
b7984
b7987
b7988
b7989
b7990
b7991
b7992
b7993
b7994
b7995
b7996
b7997
b7998
b7999
b8001
b8003
b8004
b8005
b8006
b8007
b8008
b8011
b8012
b8017
b8018
b8020
b8021
b8022
b8023
b8024
b8025
b8026
b8027
b8028
b8030
b8032
b8033
b8034
b8035
b8036
b8037
b8038
b8040
b8041
b8042
b8043
b8046
b8047
b8048
b8049
b8051
b8052
b8053
b8054
b8055
b8056
b8057
b8058
b8059
b8060
b8061
b8062
b8064
b8067
b8068
b8069
b8070
b8071
b8072
b8073
b8074
b8075
b8076
b8077
b8078
b8079
b8082
b8083
b8086
b8087
b8088
b8089
b8091
b8093
b8094
b8095
b8096
b8098
b8099
b8100
b8101
b8102
b8104
b8105
b8106
b8107
b8108
b8109
b8110
b8111
b8112
b8113
b8115
b8116
b8117
b8118
b8119
b8121
b8122
b8123
b8124
b8126
b8128
b8130
b8131
b8132
b8133
b8138
b8140
b8141
b8142
b8143
b8144
b8145
b8146
b8147
b8148
b8149
b8152
b8153
b8155
b8156
b8157
b8159
b8161
b8162
b8163
b8164
b8165
b8166
b8167
b8168
b8169
b8170
b8171
b8172
b8173
b8175
b8177
b8178
b8179
b8180
b8181
b8182
b8183
b8184
b8185
b8187
b8188
b8189
b8190
b8191
b8192
b8193
b8194
b8195
b8196
b8197
b8198
b8200
b8201
b8202
b8203
b8204
b8208
b8209
b8210
b8212
b8213
b8214
b8215
b8216
b8218
b8219
b8220
b8221
b8222
b8223
b8224
b8225
b8226
b8227
b8229
b8230
b8231
b8232
b8233
b8234
b8235
b8236
b8238
b8239
b8240
b8241
b8242
b8243
b8244
b8245
b8246
b8247
b8248
b8249
b8250
b8252
b8253
b8254
b8255
b8256
b8258
b8259
b8260
b8261
b8262
b8263
b8264
b8265
b8266
b8267
b8268
b8269
b8270
b8271
b8272
b8276
b8277
b8278
b8279
b8280
b8281
b8284
b8285
b8286
b8287
b8291
b8292
b8295
b8297
b8298
b8299
b8300
b8301
b8303
b8304
b8305
b8308
b8309
b8310
b8312
b8315
b8317
b8318
b8320
b8322
b8323
b8325
b8327
b8328
b8329
b8330
b8331
b8332
b8333
b8334
b8336
b8337
b8338
b8339
b8340
b8347
b8348
b8350
b8351
b8352
b8353
b8354
b8355
b8356
b8358
b8360
b8361
b8362
b8363
b8364
b8366
b8368
b8369
b8370
b8372
b8373
b8377
b8388
b8389
b8390
b8391
b8392
b8393
b8394
b8398
b8399
b8400
b8401
b8405
b8407
b8411
b8412
b8413
b8416
b8417
b8418
b8419
b8420
b8422
b8423
b8424
b8425
b8429
b8445
b8457
b8459
b8460
b8461
b8464
b8466
b8467
b8468
b8469
b8470
b8471
b8472
b8473
b8474
b8475
b8476
b8477
b8478
b8479
b8480
b8485
b8487
b8492
b8493
b8495
b8496
b8497
b8498
b8500
b8501
b8502
b8505
b8506
b8507
b8508
b8513
b8514
b8517
b8519
b8522
b8525
b8526
b8528
b8529
b8530
b8531
b8532
b8533
b8545
b8546
b8547
b8548
b8550
b8551
b8552
b8553
b8554
b8555
b8557
b8558
b8559
b8560
b8562
b8563
b8565
b8569
b8570
b8571
b8573
b8574
b8575
b8576
b8578
b8579
b8580
b8581
b8583
b8585
b8586
b8587
b8589
b8590
b8591
b8595
b8598
b8599
b8600
b8601
b8602
b8603
b8604
b8605
b8606
b8607
b8608
b8609
b8610
b8611
b8624
b8625
b8626
b8628
b8629
b8631
b8634
b8635
b8637
b8638
b8639
b8640
b8641
b8642
b8643
b8644
b8645
b8646
b8648
b8651
b8653
b8656
b8657
b8658
b8660
b8661
b8662
b8663
b8664
b8665
b8667
b8668
b8670
b8671
b8672
b8676
b8678
b8679
b8680
b8681
b8682
b8683
b8684
b8685
b8688
b8690
b8691
b8692
b8693
b8694
b8696
b8697
b8698
b8699
b8701
b8702
b8703
b8705
b8708
b8709
b8710
b8711
b8712
b8713
b8714
b8715
b8717
b8718
b8719
b8720
b8721
b8722
b8724
b8726
b8728
b8729
b8730
b8731
b8732
b8733
b8734
b8737
b8738
b8739
b8740
b8741
b8742
b8744
b8746
b8747
b8748
b8749
b8750
b8751
b8752
b8753
b8754
b8755
b8756
b8757
b8759
b8760
b8761
b8762
b8763
b8766
b8769
b8770
b8771
b8772
b8775
b8776
b8777
b8778
b8779
b8781
b8783
b8784
b8785
b8786
b8787
b8788
b8789
b8790
b8791
b8792
b8793
b8794
b8795
b8796
b8797
b8798
b8799
b8802
b8804
b8806
b8807
b8808
b8809
b8811
b8813
b8814
b8815
b8816
b8821
b8822
b8823
b8824
b8825
b8826
b8827
b8828
b8829
b8830
b8831
b8832
b8833
b8836
b8837
b8838
b8839
b8840
b8841
b8842
b8843
b8846
b8847
b8848
b8849
b8850
b8851
b8852
b8853
b8854
b8855
b8857
b8858
b8859
b8860
b8861
b8862
b8863
b8864
b8868
b8869
b8870
b8871
b8872
b8873
b8874
b8875
b8876
b8878
b8880
b8881
b8882
b8883
b8884
b8885
b8886
b8887
b8888
b8889
b8890
b8891
b8892
b8893
b8895
b8901
b8902
b8905
b8906
b8907
b8908
b8909
b8911
b8912
b8913
b8914
b8916
b8917
b8918
b8919
b8920
b8922
b8924
b8925
b8926
b8927
b8929
b8931
b8933
b8934
b8935
b8936
b8937
b8940
b8941
b8943
b8944
b8946
b8947
b8948
b8949
b8950
b8951
b8952
b8953
b8954
b8955
b8956
b8957
b8958
b8960
b8962
b8963
b8964
b8966
b8967
b8968
b8969
b8970
b8971
b8972
b8973
b8974
b8977
b8978
b8979
b8980
b8981
b8982
b8983
b8984
b8986
b8987
b8989
b8990
b8991
b8992
b8994
b8995
b8996
b8998
b8999
b9000
b9002
b9004
b9006
b9008
b9009
b9010
b9012
b9014
b9015
b9016
b9018
b9019
b9020
b9022
b9023
b9025
b9026
b9028
b9029
b9030
b9031
b9033
b9037
b9038
b9041
b9045
b9047
b9048
b9049
b9050
b9055
b9056
b9057
b9058
b9060
gguf-v0.*
gguf-v0.18.0
gguf-v0.19.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-43632.json"