# CVE-2026-34159: llama.cpp is an inference of several LLM models in C/C++. Prior to version b8492, the RPC backend's…

Source: https://junglewise.ai/threats/cve-2026-34159-llama-cpp-is-an-inference-of-several-llm-models-in-c-c-prior-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-01  
License: CC BY 4.0 with a link back

CVE-2026-34159 · Severity: critical · CVSS 9.8 · Published 2026-04-01

llama.cpp is an inference of several LLM models in C/C++. Prior to version b8492, the RPC backend's deserialize_tensor() skips all bounds validation when a tensor's buffer field is 0. An unauthenticated attacker can read and write arbitrary process memory via crafted GRAPH_COMPUTE messages. Combined with pointer leaks from ALLOC_BUFFER/BUFFER_GET_BASE, this gives full ASLR bypass and remote code execution. No authentication required, just TCP access to the RPC server port. This issue has been patched in version b8492.

Technologies: [GGML Llama.Cpp](https://junglewise.ai/threats/technologies/llama-cpp). Vendors: [GGML](https://junglewise.ai/threats/vendors/ggml).

## Quick answers

**Is CVE-2026-34159 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34159 being exploited in the wild.

**How severe is CVE-2026-34159?** Critical severity, with a CVSS score of 9.8, published 1 April 2026.

**Which products and versions are affected?** GGML Llama.Cpp. The advisory does not name versions.

**Is there a fix for CVE-2026-34159?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-34159?** Check whether you run GGML Llama.Cpp. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- GGML Llama.Cpp

## Related threats

- [llama.cpp integer overflow in gguf_init_from_reader](https://junglewise.ai/threats/cve-2026-116840-llama-cpp-b5854-before-b11275-contains-an-integer-overflow)
- [llama.cpp denial of service via negative top_n in reranking API](https://junglewise.ai/threats/cve-2026-52132-llama-cpp-denial-of-service-via-negative-top-n-in-reranking-api)
- [llama.cpp uncontrolled recursion denial of service in json-schema-to-grammar](https://junglewise.ai/threats/cve-2026-52131-llama-cpp-uncontrolled-recursion-denial-of-service-in-json-schema)
- [llama.cpp uncontrolled recursion in JSON schema converter](https://junglewise.ai/threats/cve-2026-52130-llama-cpp-uncontrolled-recursion-in-json-schema-converter)
- [llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI…](https://junglewise.ai/threats/cve-2026-70640-llama-cpp-builds-b1886-through-b7445-contain-a-race-condition-use)