Security readout for executives and security teams
Plain-English summary
CVE-2026-21869 affects llama.cpp’s llama-server completion endpoints. A crafted request can trigger memory corruption when the model context fills, potentially crashing the service or enabling remote code execution. The published advisory states there was no fix at publication, so exposed llama-server deployments should be treated as urgent risk.
Executive priority
Prioritize this for exposed AI inference services. The combination of possible remote code execution, crash impact, and no fix at publication makes containment and exposure reduction important until vendor guidance changes.
Technical view
In ggml-org llama.cpp commit 55d4206c8 and earlier, llama-server parses n_discard from JSON without validating it is non-negative. A negative value can cause reversed ranges and negative offsets in llama_memory_seq_rm/add during token evaluation, producing out-of-bounds writes. The issue is classified as CWE-787 with CVSS 8.8 high severity.
Likely exposure
Organizations running llama.cpp llama-server at commit 55d4206c8 or earlier are potentially exposed, especially if completion endpoints are reachable by untrusted users or networks. The source bundle does not identify specific packaged distributions, hosted services, or downstream products.
Exploitation context
The advisory describes network attack vector, low complexity, no privileges, and user interaction required by CVSS. It states deterministic memory corruption may crash the process or enable RCE. The provided sources do not report active exploitation, and this CVE is not marked KEV.
Researcher notes
Evidence is limited to the CVE record and GitHub advisory. Do not assume exploit availability or affected downstream products without additional confirmation. Focus validation on version lineage, endpoint exposure, and whether untrusted users can submit completion requests.
Mitigation direction
- Check the GitHub advisory and project releases for vendor guidance or a fix.
- Restrict llama-server completion endpoints to trusted networks and authenticated users.
- Remove public internet exposure until a validated fix or mitigation is available.
- Consider pausing affected llama-server workloads where exposure cannot be controlled.
- Monitor llama-server crashes or abnormal restarts as possible indicators.
Validation and detection
- Inventory llama.cpp deployments and identify any running llama-server components.
- Confirm whether deployed code is commit 55d4206c8 or earlier.
- Map which completion endpoints are reachable from untrusted networks or users.
- Review access controls in front of llama-server endpoints.
- Track the advisory for updates on fixed commits or supported remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-21869 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H2.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/ggml-org/llama.cpp/security/advisories/GHSA-8947-pfff-2f3cCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.