This vulnerability exists in the rpc_server::deserialize_tensor function of the ggml-org llama.cpp project, specifically in the file ggml/src/ggml-rpc/ggml-rpc.cpp. An attacker can remotely manipulate the argument 'ne' to cause a reachable assertion, potentially leading to denial of service or other impacts related to assertion failures. The vulnerability affects versions 0.1, 0.2, 0.3, and 0.4.0. No official fix or remediation level has been published, and the GitHub issue tracking this vulnerability was closed due to inactivity.

The vulnerability allows remote attackers to cause a reachable assertion failure by manipulating input to the deserialize_tensor function. This could result in denial of service or application instability. There is no evidence of privilege escalation, data confidentiality impact, or integrity compromise based on the available information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided and the issue was closed due to inactivity, users should monitor the ggml-org llama.cpp project for updates or consider applying custom input validation or sandboxing measures to mitigate potential exploitation.