Description

A vulnerability was detected in ggml-org llama.cpp up to 0.4.0. This impacts the function rpc_server::deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component RPC Server. Performing a manipulation of the argument ne results in reachable assertion. The attack is possible to be carried out remotely. The reported GitHub issue was closed automatically due to inactivity.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-07T15:17:33.843Z",
  "pubdate": "2026-09-07T15:17:33.843Z",
  "executiveSummary": "The vulnerability identified in ggml-org llama.cpp version 0.4.0 involves an improper input validation flaw within the RPC Server component. Specifically, the function rpc_server::deserialize_tensor fails to securely handle the 'ne' (number of elements) argument during the tensor deserialization process.\nThis flaw manifests as a reachable assertion, which, when triggered by a remote attacker, results in an immediate termination of the RPC server process. This constitutes a Denial of Service (DoS) vulnerability.\nThe vulnerability is remotely exploitable, requiring no prior authentication or elevated privileges. Because the RPC server is designed to process external inputs, an attacker can craft a malicious request containing an invalid or malformed 'ne' argument to force the application to abort.\nThe impact is primarily availability-based, as the assertion failure causes the service to crash, potentially disrupting dependent machine learning workflows or distributed inference tasks. The risk is considered significant in environments where the llama.cpp RPC server is exposed to untrusted network segments.",
  "technicalDetails": "The vulnerability resides in the rpc_server::deserialize_tensor function located within 'ggml/src/ggml-rpc/ggml-rpc.cpp'. The core issue stems from an insufficient validation logic applied to the tensor metadata provided during the RPC deserialization handshake.\nIn the context of ggml-rpc, the server is responsible for reconstructing tensor objects from raw network buffers. When receiving a serialized tensor, the server parses the metadata, which includes the 'ne' (number of elements) field defining the tensor's dimensions. The internal implementation utilizes assertion statements to verify that these dimensions conform to expected memory constraints or protocol-defined invariants before allocating buffers or mapping the data.\nIf an attacker submits a specially crafted RPC request where the 'ne' field contains unexpected, out-of-range, or inconsistent values, the internal assertion check fails. Because these assertions are compiled into the binary, a failed condition leads to a controlled 'abort' or 'terminate' signal being sent to the process. This behavior is intended to prevent memory corruption; however, since it is triggered by user-supplied input without prior validation, it becomes an exploitable vector for service disruption.\nThe attack flow proceeds as follows: First, the attacker establishes a network connection to the target RPC server. Second, the attacker initiates a tensor transmission protocol sequence. Third, instead of sending a valid, well-formed tensor structure, the attacker transmits a serialized payload where the 'ne' metadata is manipulated to violate the assumptions maintained by rpc_server::deserialize_tensor. Finally, upon processing this malicious payload, the RPC server executes the faulty assertion, resulting in a process crash.\nThis vulnerability is reachable remotely due to the exposed nature of the RPC protocol interface in llama.cpp up to 0.4.0. No authentication is inherently required to reach the deserialization logic once the TCP connection is established. Post-exploitation, the server remains in a crashed state until manual intervention or a service monitor restarts the process. There is no evidence suggesting that this specific assertion leads to arbitrary code execution (ACE), but the ease of remote triggering renders it a high-utility target for DoS attacks."
}