CVE-2026-86317: llama.cpp RPC Server RCE Vulnerability

CVE-2026-86317 Overview

CVE-2026-86317 is a reachable assertion vulnerability in ggml-org llama.cpp versions up to 0.4.0. The flaw resides in the rpc_server::deserialize_tensor function within ggml/src/ggml-rpc/ggml-rpc.cpp, part of the RPC Server component. An attacker can manipulate the ne argument to trigger an assertion failure, causing the process to abort. The issue is classified as [CWE-617] Reachable Assertion and is exploitable remotely without authentication or user interaction.

Critical Impact
Remote attackers can crash the llama.cpp RPC server by sending a crafted tensor deserialization request, resulting in denial of service for AI inference workloads.

Affected Products

ggml-org llama.cpp versions up to and including 0.4.0
Deployments exposing the llama.cpp RPC Server component
AI inference environments running the ggml-rpc module

Discovery Timeline

2026-09-07 - CVE-2026-86317 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86317

Vulnerability Analysis

The vulnerability affects the rpc_server::deserialize_tensor function inside ggml/src/ggml-rpc/ggml-rpc.cpp. This function processes tensor data received over the RPC (Remote Procedure Call) interface used by llama.cpp for distributed inference. When deserializing an incoming tensor, the code validates dimensional metadata through assertion checks rather than through defensive input validation that returns errors gracefully.

An attacker who can reach the RPC endpoint can craft a request with a malformed ne (number of elements) argument. This causes the assertion to fire and the server process to terminate. The result is a denial of service against the AI inference backend. According to the advisory, the associated GitHub issue was closed automatically due to inactivity, indicating no upstream patch commitment at time of disclosure.

Root Cause

The root cause is the use of assertions for validating untrusted input from network peers. Assertions are intended for internal invariants, not for enforcing constraints on adversary-controlled data. When the ne tensor dimension argument violates the expected invariant, assert() aborts the process instead of returning a controlled error to the RPC client.

Attack Vector

Exploitation requires network access to the llama.cpp RPC Server. No authentication, privileges, or user interaction are required. An attacker sends a crafted deserialize_tensor request over the RPC channel with a manipulated ne argument value. The server evaluates the assertion, fails the check, and terminates. Repeated requests can sustain the denial of service against the inference service.

No verified proof-of-concept code has been published. Refer to the GitHub Issue #25288 and the VulDB entry for CVE-2026-86317 for additional technical context.

Detection Methods for CVE-2026-86317

Indicators of Compromise

Unexpected termination of the llama.cpp RPC server process with an assertion failed message in stderr or system logs
Repeated inbound connections to the llama.cpp RPC listener port from untrusted sources
Sudden gaps in inference service availability correlated with RPC traffic spikes
Core dumps or crash reports referencing rpc_server::deserialize_tensor or ggml-rpc.cpp

Detection Strategies

Monitor process lifecycle events for the llama.cpp RPC binary and alert on abnormal exit codes
Inspect application logs for assertion failure strings tied to tensor deserialization
Deploy network sensors to flag malformed RPC payloads reaching the ggml-rpc listener
Correlate service restarts with preceding external RPC connections to identify targeting

Monitoring Recommendations

Track availability metrics for AI inference endpoints and alert on repeated crash-restart cycles
Log all connections to the llama.cpp RPC port and baseline normal client behavior
Retain crash artifacts and stack traces referencing ggml-rpc for post-incident analysis

How to Mitigate CVE-2026-86317

Immediate Actions Required

Restrict network access to the llama.cpp RPC Server so only trusted inference clients can connect
Remove the RPC listener from any internet-facing interface and bind it to localhost or a private subnet
Place the RPC endpoint behind a firewall, VPN, or service mesh with mutual authentication
Inventory all llama.cpp deployments at version 0.4.0 or earlier that expose the RPC component

Patch Information

No official upstream patch is referenced in the advisory. The related GitHub Issue #25288 was closed automatically due to inactivity. Track the ggml-org llama.cpp repository for future releases addressing the rpc_server::deserialize_tensor assertion and upgrade to a fixed version when available.

Workarounds

Disable the ggml-rpc component if distributed inference is not required for the workload
Enforce network segmentation so the RPC port is unreachable from untrusted networks
Add a reverse proxy or gateway that validates RPC payload structure before forwarding
Configure process supervisors to rate-limit automatic restarts, reducing amplification from crash loops

bash

# Restrict llama.cpp RPC access to localhost only
# Bind the RPC server to the loopback interface
./llama-rpc-server --host 127.0.0.1 --port 50052

# Firewall example: block external access to the RPC port
sudo iptables -A INPUT -p tcp --dport 50052 ! -s 127.0.0.1 -j DROP