llama.cpp EUVD-2026-72459

Exploitation requires that the llama.cpp RPC server is explicitly compiled into the binary (non-default build flag -DGGML_RPC=ON) and actively running and network-reachable on its listening port (default 50052/tcp). The RPC server is not started by default in any llama.cpp configuration - an operator must deliberately launch llama-rpc-server or an equivalent invocation. No authentication is required once the server is reachable; the CVSS 4.0 vector confirms PR:N. Exploitation is limited to availability impact only (process crash/abort) with no confidentiality or integrity consequences. Deployments using llama.cpp exclusively for local or GPU-accelerated inference without the RPC component are entirely unaffected.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms unauthenticated network exploitation with no attack complexity once the RPC server is reachable, but scores the vulnerable-system availability impact as VA:L. This appears to understate the impact: a triggered assertion causes abort(), terminating the entire server process - effectively a complete, if temporary, availability loss for the RPC service. Real-world risk is substantially gated by the deployment condition: the llama.cpp RPC server is an optional, non-default feature that must be explicitly compiled (typically with -DGGML_RPC=ON) and deliberately started by the operator, usually on a trusted network. Without the RPC server running, this CVE is not exploitable. No exploit code is public, no KEV listing exists, and EPSS data was not provided. The risk to typical llama.cpp deployments (CPU/GPU inference without RPC) is zero; the risk to distributed/multi-node setups with the RPC server exposed is a straightforward remote crash. The upstream issue closure due to inactivity raises concern that no patch is forthcoming.

An attacker with network access to an exposed llama.cpp RPC server sends a crafted binary RPC request where the tensor descriptor's ne (element-count/shape) field contains an invalid or out-of-range value. The deserialize_tensor function passes this value to an assertion check, which fails and calls abort(), immediately terminating the server process and interrupting any ongoing inference workload. No public proof-of-concept exists, but the attack requires only knowledge of the RPC protocol wire format, which is documented in the open-source codebase.