CVE-2026-86317: Reachable Assertion in ggml-org llama.cpp

This vulnerability exists in the rpc_server::deserialize_tensor function within the ggml/src/ggml-rpc/ggml-rpc.cpp file of the ggml-org llama.cpp project. Manipulating the argument 'ne' leads to a reachable assertion, potentially causing the application to crash or behave unexpectedly. The issue affects versions 0.1 through 0.4.0 inclusive. The vulnerability can be triggered remotely, indicating that an attacker can exploit it over a network without prior access or privileges. The reported GitHub issue was closed due to inactivity, and no patch or fix information is provided in the available data.

Exploitation of this vulnerability can cause the RPC server component to hit an assertion failure, which may lead to denial of service or application instability. Since the attack vector is remote and requires no privileges or user interaction, it poses a risk of disruption to services relying on the affected component. There is no indication of code execution or data compromise from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided and the GitHub issue was closed due to inactivity, users should monitor vendor channels for updates. Until a fix is available, consider restricting access to the RPC server component or implementing network-level controls to limit exposure.