Llama's Paradox - Delving deep into Llama.cpp and exploiting Llama.cpp's Heap Maze, from Heap-Overflow to Remote-Code Execution

“Since Llama.cpp has such a special heap-management system, special features of this system will fail the classic ptmalloc exploitations that we are familiar with.”

llama.cpp’s RPC server shipped with no bounds checks on buffer data. The fix added four layers of checks, and a researcher still turned tensor size math into remote code execution. Do not expose the RPC server to anyone you do not trust.