This vulnerability in ggml-org llama.cpp arises from improper handling in the _visit_pattern function within common/json-schema-to-grammar.cpp, leading to a null pointer dereference. The flaw can be exploited remotely without authentication or user interaction. The issue is documented under CVE-2026-17500 with a CVSS 4.0 score of 6.9 (medium severity). Although a pull request containing a fix exists, it has not yet been merged or officially released. No known exploits are reported in the wild.

Successful exploitation results in a null pointer dereference, which typically causes a denial of service by crashing the affected process. There is no indication of privilege escalation, data disclosure, or code execution. The vulnerability can be triggered remotely without authentication, increasing its potential impact on availability.

No official patch or fix is currently available as the pull request is pending acceptance. Users should monitor the vendor's repository or advisory channels for the acceptance and release of the fix. Until then, consider restricting access to the vulnerable functionality if possible to reduce exposure.