EUVD-2026-112818
GHSA-rr32-94xq-hrxw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed ggml-rpc server
-
DeliveryComplete HELLO handshake
-
ExploitSend SET_TENSOR with oversized length
-
ExecutionUncaught std::length_error aborts process
-
ImpactService denied to all clients
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Exception handling completeness
|
| Exploitation Conditions | Requires a running llama.cpp ggml-rpc server (the rpc-server distributed-inference backend) that is reachable over the network by the attacker. Exploitation needs only completion of the protocol HELLO handshake - no credentials - after which a single command (e.g. SET_TENSOR) carrying a length above std::vector::max_size() triggers the crash. The primary limiting factor is deployment: rpc-server is an optional, non-default mode, so only installations that explicitly enable and expose it are affected; hosts that bind it to localhost or behind network controls are not remotely reachable. No user interaction or specific platform is required beyond having the vulnerable b2877-through-pre-b11935 build. |
| Impact | This is a genuine but bounded availability-only risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) and the description agree that exploitation is remote, low-complexity, and requires no authentication beyond the protocol's HELLO handshake - a consistent, non-conflicting signal set. However, impact is confined to availability (VC:N/VI:N/VA:H; no confidentiality or integrity loss): the flaw only crashes the ggml-rpc server, it does not enable code execution or data access. No EPSS score, KEV listing, or working exploit was supplied, so there is no evidence of active exploitation - the elevated 8.7 score is driven by the ease and reach of the crash, not by broad real-world attack activity. The vuln.today Decision label is 'this_week' (not act_now/emergency), which matches a serious-but-not-critical DoS. The most important limiting factor, not reflected in the network vector, is that the vulnerable ggml-rpc server is an optional distributed-inference mode that must be deliberately deployed and network-exposed; it is not part of a default llama.cpp setup. Treat this as a prompt-patch DoS for anyone actually running rpc-server, rather than a universal emergency. |
| Exploit ScenarioDerived | An attacker who can reach a network-exposed llama.cpp ggml-rpc server completes the HELLO handshake, then sends a command such as SET_TENSOR declaring a message length greater than std::vector::max_size(). The oversized allocation request throws an uncaught std::length_error that aborts the process, denying service to all connected clients. No public working exploit code was identified in the provided data, though the vendor PR diff documents the exact trigger. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 29, 2026
Unauthenticated remote attackers can terminate the llama.cpp ggml-rpc rpc-server process - and with it every distributed-inference session it is serving - by sending a command whose declared message length exceeds std::vector::max_size() once the protocol HELLO handshake completes. Builds from b2877 through b11934 are affected: the exception thrown while sizing the receive buffer is a std::length_error, which the server's handler did not catch, so the process aborts instead of rejecting the frame. No public exploit code was identified at time of analysis, and reachability is bounded by deployment - rpc-server is an optional, non-default backend, so only installations that explicitly enable and expose it on the network are at risk. Availability-only impact; no confidentiality or integrity effect.
RemediationAI
Upgrade llama.cpp to build b11935 or later (https://github.com/ggml-org/llama.cpp/releases/tag/b11935); that release incorporates the upstream fix commit 7ecb57f7adbea2928aa468ad2aecf05b10725ad4 and PR 31204 (https://github.com/ggml-org/llama.cpp/pull/31204), which catches std::length_error in recv_msg() and closes the connection instead of aborting. Distributors who rebuild from source rather than tracking release tags should cherry-pick that commit. If upgrading cannot happen immediately, the practical mitigation is exposure reduction, since the vulnerable path only exists in the optional ggml-rpc backend: do not run rpc-server on untrusted networks, bind it to loopback or to a dedicated management interface, and firewall the RPC port so that only known inference peers can connect - the trade-off is that this restricts the multi-host distributed inference topology the backend exists to provide. Stopping or not enabling rpc-server entirely removes the attack surface at the cost of distributed execution. Per the vendor and reporter, applying the upstream fix is the complete remedy; the compensating controls above reduce reachability but do not correct the uncaught exception in unpatched builds.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ggml-rpc is llama.cpp's backend for splitting model inference across multiple hosts: an rpc-server process exposes tensors and compute over a socket protocol, and the client side in ggml/src/ggml-rpc/ggml-rpc.cpp receives framed messages through recv_msg(), which reads an attacker-supplied 64-bit length and then sizes a std::vector<uint8_t> input buffer to that value (the affected code is the recv_msg block at lines 344-356 of the referenced snapshot). The original error handling caught only std::bad_alloc, but std::vector refuses an allocation request above its max_size() by throwing std::length_error instead - a different exception type that escaped the handler, propagated out of the receive path, and terminated the process via the uncaught-exception abort path. This maps to CWE-248 (Uncaught Exception), a resource-exhaustion/robustness class in which hostile input reaches an error condition the code was not written to handle; the improper-length-validation angle is also consistent with CWE-130-style input length issues. The upstream fix (PR 31204, commit 7ecb57f7adbea2928aa468ad2aecf05b10725ad4) adds an explicit catch for std::length_error that logs the offending size and returns false, converting the fatal abort into a clean connection-level rejection. No authentication is involved: the length field is processed after the HELLO handshake, which requires no credentials, and the CVSS vector confirms PR:N/AC:L/UI:N with only availability impact (VA:H).
Know when Llama Cpp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote, no authentication beyond the HELLO handshake (PR:N) and a trivially crafted oversized length (AC:L); impact is a process abort only, so A:H with C:N/I:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc server that allows unauthenticated remote attackers to crash the rpc-server by sending oversized message lengths. After the HELLO handshake, attackers can send a command such as SET_TENSOR with a length above std::vector::max_size(), triggering an uncaught std::length_error that aborts the process and denies service to all clients.
Executive ViewAI
A vulnerability in llama.cpp's optional rpc-server component (CVE-2026-119052) allows unauthenticated remote attackers to crash the server, disrupting distributed-inference sessions. This affects only organizations that have explicitly enabled and exposed rpc-server on the network, but for those, the business impact is operational disruption and potential SLA violations. Leadership should prioritize patching or isolating affected systems to maintain service availability and protect revenue-generating AI workloads.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Arbitrary memory write in llama.cpp's RPC server allows remote unauthenticated attackers to corrupt arbitrary memory add
Remote code execution in llama.cpp (commit 18c2e17) is possible when a user opens a malicious .gguf model file, triggeri
Llama.cpp server endpoints fail to validate the n_discard parameter from JSON input, allowing negative values that trigg
Remote code execution in llama.cpp (commit 18c2e17) is possible when a victim loads a malicious .gguf model file, trigge
Remote code execution in llama.cpp (GGUF library) allows attackers to achieve arbitrary code execution by tricking a use
Remote code execution in llama.cpp (commit 18c2e17) occurs when the GGUF library's gguf_fread_str function parses a mali
Heap-based buffer overflow in llama.cpp's GGUF library header parser (commit 18c2e17) enables code execution when a vict
CVE-2025-52566 is a signed vs. unsigned integer overflow vulnerability in llama.cpp's tokenizer (llama_vocab::tokenize f
Remote code execution in llama.cpp RPC backend allows unauthenticated attackers with TCP access to achieve arbitrary mem
llama.cpp provides LLM inference in C/C++. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable,
Heap buffer overflow in llama.cpp's server KV cache state-restore path (builds b4882 through b9058) lets an attacker who
Stack-based out-of-bounds write in llama.cpp's ggml-rpc RDMA receive path (builds b8841 through b11865) lets unauthentic
Exploit-DB