llama.cpp before b8585 contains a use-after-free vulnerability in the RPC server's GRAPH_RECOMPUTE handler that allows unauthenticated remote attackers to achieve arbitrary read and write access by storing a computation graph, freeing referenced buffers, and reclaiming freed memory with attacker-controlled content. Attackers can send RPC requests to trigger re-execution of stored graphs with dangling pointers, enabling full remote code execution without requiring authentication or user interaction.

CVE-2026-39909 is a critical use-after-free vulnerability discovered in llama.cpp versions prior to build b8585. The flaw resides in the RPC server's GRAPH_RECOMPUTE handler, which improperly manages memory for stored computation graphs. Unauthenticated remote attackers can exploit this by storing a computation graph, freeing its referenced buffers, and then reclaiming the freed memory with attacker-controlled content. By sending crafted RPC requests to trigger re-execution of the stored graphs with dangling pointers, attackers can achieve arbitrary memory read and write access. This ultimately enables full remote code execution (RCE) without requiring authentication or any user interaction. The vulnerability has been patched in llama.cpp release b8585 via a commit to the ggml-org repository. Given the unauthenticated remote exploitation vector and RCE impact, this is considered a critical severity issue.