EUVD-2026-64671
GHSA-f4vj-w5xq-5xph
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible RPC endpoint with no authentication (PR:N); partial C/I/A impact consistent with CVSS 4.0 VC:L/VI:L/VA:L; scope unchanged as no cross-system impact indicated.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Performing a manipulation of the argument op/op_params results in deserialization. The attack may be initiated remotely. This vulnerability is distinct from CVE-2026-34159 (GHSA-j8rj-fmpv-wcxw, PR #20908), which only added a buffer==nullptr rejection in create_node() and does not validate op or op_params. The reported GitHub issue was closed automatically due to inactivity.
AnalysisAI
Improper input validation in llama.cpp's ggml-RPC Server allows remote unauthenticated attackers to send crafted deserialization payloads targeting the deserialize_tensor function, affecting the op and op_params arguments in ggml/src/ggml-rpc/ggml-rpc.cpp at commit bec4772f6. The CVSS 4.0 score of 6.9 (AV:N/AC:L/PR:N/UI:N) reflects network-accessible exploitation with partial confidentiality, integrity, and availability impact on the vulnerable system. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The ggml-RPC server must be running and reachable over the network - this component is not enabled by default in standard llama.cpp builds and must be explicitly compiled and launched. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates the highest-severity access conditions: network-reachable, low complexity, no privileges, no user interaction, no attack prerequisites. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network access to an exposed ggml-RPC server sends a crafted RPC request to the tensor deserialization endpoint, supplying a malformed or out-of-range value for the `op` or `op_params` fields in the tensor descriptor. Because `deserialize_tensor` does not validate these fields, the server may process the payload in an unsafe manner - potentially causing memory corruption, unexpected code path execution, or information disclosure depending on how downstream tensor operation handlers consume unvalidated parameters. … |
| Remediation | No vendor-released patch addressing `op` and `op_params` validation in `deserialize_tensor` has been confirmed at time of analysis - the GitHub issue was closed due to inactivity without a confirmed fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today