Executive brief
llama.cpp is a popular C/C++ library for running large language models. The RPC (Remote Procedure Call) server component fails to validate tensor dimensions from network requests, allowing an unauthenticated remote attacker to send a crafted message that triggers a fatal assertion in the server, causing it to crash. This is a denial-of-service attack that disrupts LLM inference services relying on the RPC server.
Technical details
The vulnerability is a missing input validation (CWE-617 assertion failure) in the deserialize_tensor() function within ggml/src/ggml-rpc/ggml-rpc.cpp. The function accepts attacker-controlled tensor dimension values (ne[0]) from network messages without verifying that they meet alignment requirements for the tensor's data type (specifically, quantized types like Q4_0 require ne[0] to be a multiple of the block size, 32 or 256 bytes). When an invalid dimension is passed to ggml_new_tensor_4d(), it triggers an assert() in ggml_row_size(), causing SIGABRT and server termination. The attack requires no authentication and can be carried out over the network via a simple two-message sequence (HELLO handshake + crafted SET_TENSOR/GET_TENSOR RPC command) to the default RPC listening port (TCP 50052). At least six RPC command types expose this vulnerability. No known public patch is available as of the advisory date.
Affected products
- ggml-org llama.cpp up to 0.4.0
Timeline
- 2026-07-03: disclosed: GitHub issue #25288 opened reporting the vulnerability
- 2026-09-07: advisory: CVE-2026-86317 published to NVD