EUVD-2026-110065
GHSA-qh3g-v296-6ghm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach network-exposed llama.cpp server
-
DeliverySend request enabling Mirostat sampler
-
ExploitSupply params yielding non-finite/zero-sum probabilities
-
ExecutionTrigger reachable assertion in sampler
-
ImpactProcess aborts, inference service denied
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V16 - Security Logging and Error Handling Reachable assertion handling
|
| Exploitation Conditions | Requires the Mirostat sampler (v1 or v2) to be the active sampling mode - a non-default sampling method that the client/request must explicitly select - on a llama.cpp instance reachable over the network and accepting attacker-influenced sampling parameters or inputs that cause token probabilities to become non-finite (NaN/Inf) or sum to zero, which then reaches the assertion in src/llama-sampler.cpp. Limiting factors: only deployments that expose an inference endpoint (e.g. llama-server) to untrusted callers and permit Mirostat are affected; impact is limited to availability (process abort / DoS) with no code execution, data disclosure, or integrity effect. The precise value range that produces the non-finite/zero-sum condition is not described in the available sources. |
| Impact | Signals are consistent and point to a moderate, availability-only issue rather than an urgent one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated trigger, but every impact metric except availability is None (VA:L), so this is a denial-of-service with no confidentiality or integrity consequence. There is no CISA KEV listing and no EPSS score was supplied, so widespread or automated exploitation is not evidenced; exploitation status is 'no public exploit identified at time of analysis' (the only non-advisory GitHub link is the proposed fix PR, not a PoC). The vuln.today decision label is 'this_month', i.e. a planned-remediation priority, not act_now/emergency. One conflict to verify: the input states 'Patch: Available from vendor', yet the description says the project 'has not reacted yet' and the referenced PR #29992 appears to be an externally-proposed fix - so a merged, released fixed version is not clearly confirmed. Net: a real but bounded issue (crash/DoS) that is primarily relevant to anyone exposing a llama.cpp inference server with the Mirostat sampler reachable by untrusted clients. |
| Exploit ScenarioDerived | An attacker who can reach a network-exposed llama.cpp inference endpoint (e.g. llama-server) issues a completion request that selects the Mirostat sampler and supplies parameters/inputs that drive token probabilities to non-finite or zero-sum values. This reaches an assertion in src/llama-sampler.cpp (top_k with a non-finite k, or non-finite/zero-sum probabilities handed to std::discrete_distribution), aborting the process and denying inference service. No public exploit code was identified; the only code artifact is the proposed fix PR #29992. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 26, 2026
Reachable assertion in llama.cpp (through 0.7.0) lets unauthenticated remote callers abort the inference process by driving the non-default Mirostat sampler into non-finite or zero-sum token probabilities, producing a denial of service that is confined to availability. Only deployments that expose an inference endpoint such as llama-server to untrusted clients - and that permit those clients to select Mirostat v1/v2 and influence sampling parameters or inputs that make probabilities non-finite - are affected; there is no code execution, data disclosure or integrity impact. No public exploit code and no CISA KEV entry were identified at time of analysis, and the issue carries a moderate this_month priority rather than urgent handling. The flaw was reported upstream through pull request #29992, which adds the missing guards; a tagged release containing that fix is not independently confirmed.
RemediationAI
The primary fix is the upstream change in pull request https://github.com/ggml-org/llama.cpp/pull/29992, which adds a std::isfinite guard and minimum of 1 for the derived top-k value in llama_sampler_mirostat_apply and an any_valid probability check in llama_sampler_mirostat_v2_apply; because this exists as a PR rather than a tagged release, an upstream fix is available (PR/commit) but a released patched version is not independently confirmed, so builds should be taken from the merged commit or a release confirmed to contain it. Until then, the two actionable compensating controls follow directly from the preconditions: first, restrict the llama-server inference endpoint to trusted callers behind an authenticating proxy or network allowlist, which removes remote reachability at the cost of constraining who can use the service; second, reject or strip requests that select the Mirostat or Mirostat-v2 sampler (and validate client-supplied sampling parameters for non-finite values) in the serving layer, which keeps the process alive at the cost of removing a supported sampling mode and may be incomplete because the exact parameter range that triggers the non-finite or zero-sum condition is not documented.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
llama.cpp is a C/C++ inference engine for large language models whose sampling pipeline lives in src/llama-sampler.cpp. The Mirostat samplers (both v1 and v2) adaptively truncate the candidate token distribution using a target-surprise parameter, deriving a cutoff value k that is passed to the internal top-k implementation and, in v2, forwarding the resulting probability weights to a discrete distribution routine that requires finite, positive weights. CWE-617 (Reachable Assertion) describes the root cause class: the code assumes the derived cutoff and probability weights are well-formed, and a violated assumption trips an assertion rather than being handled, terminating the process. The upstream diff in PR #29992 confirms the two weak points - it replaces the raw cast of k with a finite-and-positive check clamped to at least 1 before calling llama_sampler_top_k_impl, and it adds an any_valid scan that rebuilds a single-entry unit distribution when no candidate probability is finite and positive. This is attacker-reachable only when Mirostat (v1 or v2) is the active sampling mode, which is not the default and must be explicitly selected by the client or request, and only on an instance reachable over the network that accepts attacker-influenced sampling parameters; the precise parameter value range that produces the non-finite or zero-sum condition is not described in the available sources.
Know when Llama Cpp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Network-reachable server accepts attacker-chosen Mirostat parameters unauthenticated (AV:N/PR:N/AC:L); the reachable assertion aborts the whole process (A:H); no confidentiality or integrity impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A security flaw has been discovered in ggml-org llama.cpp up to 0.7.0. Affected by this vulnerability is an unknown functionality of the file src/llama-sampler.cpp of the component Mirostat Sampler. The manipulation results in reachable assertion. It is possible to launch the attack remotely. The project was informed of the problem early through a pull request but has not reacted yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Arbitrary memory write in llama.cpp's RPC server allows remote unauthenticated attackers to corrupt arbitrary memory add
Remote code execution in llama.cpp (commit 18c2e17) is possible when a user opens a malicious .gguf model file, triggeri
Llama.cpp server endpoints fail to validate the n_discard parameter from JSON input, allowing negative values that trigg
Remote code execution in llama.cpp (commit 18c2e17) is possible when a victim loads a malicious .gguf model file, trigge
Remote code execution in llama.cpp (GGUF library) allows attackers to achieve arbitrary code execution by tricking a use
Remote code execution in llama.cpp (commit 18c2e17) occurs when the GGUF library's gguf_fread_str function parses a mali
Heap-based buffer overflow in llama.cpp's GGUF library header parser (commit 18c2e17) enables code execution when a vict
CVE-2025-52566 is a signed vs. unsigned integer overflow vulnerability in llama.cpp's tokenizer (llama_vocab::tokenize f
Remote code execution in llama.cpp RPC backend allows unauthenticated attackers with TCP access to achieve arbitrary mem
llama.cpp provides LLM inference in C/C++. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable,
Heap buffer overflow in llama.cpp's server KV cache state-restore path (builds b4882 through b9058) lets an attacker who
Stack-based out-of-bounds write in llama.cpp's ggml-rpc RDMA receive path (builds b8841 through b11865) lets unauthentic
Exploit-DB