CVE-2026-39909

The vulnerability exists in the RPC server's GRAPH_RECOMPUTE handler of llama.cpp, allowing unauthenticated remote attackers to exploit a use-after-free condition. This flaw enables attackers to achieve arbitrary read and write access by manipulating computation graphs, potentially leading to full remote code execution. Organizations using affected versions should prioritize patching this vulnerability to mitigate the risk of unauthorized access and control over their systems.