A null pointer dereference (CWE-476) is present in the _visit_pattern function of the json-schema-to-grammar.cpp component of llama.cpp. The flaw can be triggered remotely and may cause the library to crash or hang, resulting in a denial of service to users who load or parse JSON schemas. The vulnerability also involves improper resource handling (CWE-404) which contributes to the crash risk. There is no evidence that arbitrary code execution can be achieved; the risk remains limited to service disruption.

The vulnerability affects the ggml-org llama.cpp project and applies to the code base between the commits d006858 and e15efe0. No specific release numbers or version ranges are listed, so any build derived from these commits is potentially impacted.

The CVSS score of 6.9 categorizes the flaw as moderate. EPSS score is < 1%, indicating a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is remote, implying that an external actor could supply a crafted JSON schema to trigger the flaw, leading to service interruption. Until a patch is released, the main risk is downtime rather than privilege escalation or data compromise.