INFRASTRUCTURE CRITICAL NEW
Unauthenticated RCE in llama.cpp's distributed-inference RPC backend
A missing bounds check in llama.cpp's RPC backend lets any client with TCP access to the server port read and write process memory and reach remote code execution. Fixed in b8492.
2026-07-10 // 6 min
Read full breakdown →
# example prompt — illustrative, defensive
# llama.cpp RPC graph-compute RCE (illustrative, defensive)
# The tensor parser only bounds-checks data when buffer != 0:
if tensor.buffer: # attacker sets buffer = 0 to skip this
validate(tensor.data) # [bounds check lives only here]
result.data = tensor.data # [payload] taken from the wire unconditionally
# Root cause: reachability == compromise; the RPC protocol has no auth.
# Defense: upgrade to build b8492+, bind ggml-rpc-server to 127.0.0.1,
# never publish port 50052, and tunnel nodes over mTLS/WireGuard.