This vulnerability is an assertion failure in the Mirostat Sampler component of ggml-org llama.cpp, reachable through malformed input. The flaw is identified as CWE‑617 (Use of Uninitialized Variable) and allows a remote actor to trigger the assertion, potentially leading to a crash or other unintended behavior. As the assertion fault terminates the process, the principal impact is a denial of service, although the assertion boundary could also be leveraged for other forms of exploitation if additional memory handling flaws exist. The description states the flaw is exploitable over the network, indicating remote vulnerability.

All deployments of ggml-org llama.cpp on versions up to and including 0.7.0 are affected. No official fix has been released for these releases, and users should verify that their installed version does not fall within this vulnerable range.

The CVSS score of 6.9 classifies the issue as moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The advisory confirms that the attack can be launched remotely, implying a Network access vector. Given the lack of a publicly available exploit and the absence of a patch, the current exploitation risk is moderate, but users should monitor the project for updates and consider mitigating exposure until a fix is published.