EUVD-2026-64672
GHSA-7hmx-m2vh-6qvw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed ggml-RPC TCP port
-
DeliveryConnect without authentication
-
ExploitCraft binary graph payload with node id=0
-
ExecutionSend payload to rpc_server::graph_compute
-
PersistNull check guard bypassed for id=0
-
ImpactNull pointer dereference crashes server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The ggml-RPC server must be explicitly enabled and running - it is not started by default in llama.cpp and requires operators to launch the rpc-server binary. The server's TCP port must be reachable by the attacker; the CVSS 4.0 AV:N/PR:N/UI:N vector confirms no authentication and no user interaction are required. The flaw is a pure C++ logic error with no OS, hardware, or platform dependency - any system running the ggml-RPC server is affected regardless of GPU type or OS. The primary limiting factor is network exposure: deployments where the RPC port is bound to localhost or a firewalled internal interface are not remotely exploitable despite the network attack vector classification. |
| Impact | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation requiring no user interaction - a single malformed TCP packet suffices. Impact is strictly denial of service: VA:L in the 4.0 base vector with all confidentiality and integrity metrics set to N, consistent with a non-escalating process crash. The assigned VA:L appears conservative given that a crash terminates all in-progress inference tasks; independently, A:H in CVSS 3.1 terms better reflects a complete availability loss for the affected service. No EPSS data is present in available intelligence, preventing probabilistic comparison. KEV status is negative and no weaponized public exploit exists - the only triggering artifact is the PR's bundled test script, which is not a standalone attack tool. Real-world risk is tightly coupled to deployment topology: instances binding only to localhost or an isolated inference fabric are effectively unexploitable remotely, while deployments exposing the RPC port on shared or public infrastructure face trivial, authentication-free crashes. The upstream fix is an unmerged pull request, so every current llama.cpp release is unpatched. |
| Exploit ScenarioDerived | An attacker with TCP connectivity to the ggml-RPC port connects without authentication and sends a binary graph payload encoding a single graph node with id=0. The rpc_server::graph_compute function calls create_node, receives nullptr, and the exempted null check allows the null pointer to flow into computation, crashing the server process immediately. The upstream PR's bundled test script confirms this is reproducible with a 20-byte crafted packet. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 23, 2026
Null pointer dereference in llama.cpp's ggml-RPC server (commit bec4772f6) allows remote unauthenticated denial of service against any deployment exposing the RPC port to the network. The flaw resides in rpc_server::graph_compute, where a graph node with id=0 bypasses a conditional null check, enabling a single crafted TCP packet to crash the server process. No standalone exploit code is publicly available at time of analysis, though the upstream fix PR includes a Python test script that reproducibly triggers the crash in under one second.
RemediationAI
The upstream fix is available as open pull request https://github.com/ggml-org/llama.cpp/pull/25670, but it has not yet been merged into a tagged release - no patched release version can be cited at time of analysis. Operators should monitor that PR for merge and build from the patched commit immediately once accepted. As an immediate compensating control, restrict access to the RPC server port via firewall rules or bind rpc-server explicitly to 127.0.0.1 or a trusted private network interface only; this eliminates the remote attack surface entirely without affecting local inference. If distributed RPC functionality is not required, disable the ggml-RPC server at build time or simply do not launch rpc-server - the vulnerability only exists in processes where that server is actively running. Network segmentation confining RPC traffic to trusted GPU nodes is the most effective interim mitigation with no operational downside for non-distributed deployments.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
llama.cpp (CPE: cpe:2.3:a:ggml-org:llama.cpp:*:*:*:*:*:*:*:*) is an open-source C++ inference engine for large language models; its ggml-RPC component enables distributed GPU inference by serializing computational graphs over a custom binary TCP protocol. In the vulnerable code path, rpc_server::graph_compute deserializes graph nodes from raw network input. The helper create_node returns nullptr for node id=0, which was intentionally permitted for optional tensor sources. A flawed conditional - 'if (graph->nodes[i] == nullptr && id != 0)' - explicitly excluded id=0 nulls from error handling, meaning a crafted payload with a graph node id of 0 propagates a null pointer into downstream computation without protection. CWE-476 (Null Pointer Dereference) describes this precisely: an attacker-controlled deserialized value is used as a pointer without validation. The fix in PR #25670 removes the 'id != 0' exemption so any null graph node is treated as a deserialization error regardless of id.
Know when Llama Cpp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Network-accessible unauthenticated RPC port, single-packet crash with no confidentiality or integrity impact; process crash warrants A:H over A:L.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A vulnerability was determined in ggml-org llama.cpp bec4772f6. This affects the function rpc_server::graph_compute of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Executing a manipulation can lead to null pointer dereference. The attack may be launched remotely. The pull request to fix this issue awaits acceptance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Arbitrary memory write in llama.cpp's RPC server allows remote unauthenticated attackers to corrupt arbitrary memory add
Remote code execution in llama.cpp (commit 18c2e17) is possible when a user opens a malicious .gguf model file, triggeri
Llama.cpp server endpoints fail to validate the n_discard parameter from JSON input, allowing negative values that trigg
Remote code execution in llama.cpp (commit 18c2e17) is possible when a victim loads a malicious .gguf model file, trigge
Remote code execution in llama.cpp (GGUF library) allows attackers to achieve arbitrary code execution by tricking a use
Remote code execution in llama.cpp (commit 18c2e17) occurs when the GGUF library's gguf_fread_str function parses a mali
Heap-based buffer overflow in llama.cpp's GGUF library header parser (commit 18c2e17) enables code execution when a vict
CVE-2025-52566 is a signed vs. unsigned integer overflow vulnerability in llama.cpp's tokenizer (llama_vocab::tokenize f
Remote code execution in llama.cpp RPC backend allows unauthenticated attackers with TCP access to achieve arbitrary mem
llama.cpp provides LLM inference in C/C++. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable,
Heap buffer overflow in llama.cpp's server KV cache state-restore path (builds b4882 through b9058) lets an attacker who
Stack-based out-of-bounds write in llama.cpp's ggml-rpc RDMA receive path (builds b8841 through b11865) lets unauthentic
Exploit-DB