A vulnerability was detected in ggml-org llama.cpp up to 0.4.0. (CVE-2026-86317)

CVE-2026-86317 describes a vulnerability in the RPC Server component of ggml-org llama.cpp up to version 0.4.0, specifically in the rpc_server::deserialize_tensor function within ggml/src/ggml-rpc/ggml-rpc.cpp. An attacker can remotely manipulate the argument 'ne' to cause a reachable assertion failure, potentially leading to denial of service. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts only availability. The GitHub issue tracking this vulnerability was closed due to inactivity, and no patch or remediation details are available.

The vulnerability allows a remote attacker to cause an assertion failure in the RPC Server component, leading to potential denial of service. There is no impact on confidentiality or integrity. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or fix information is provided and the GitHub issue was closed due to inactivity, users should monitor official sources for updates. Until a fix is available, consider restricting access to the RPC Server component to trusted networks to reduce exposure.