The vulnerability is a deserialization flaw in the ggml-RPC Server’s deserialize_tensor function, triggered by manipulation of the op/op_params arguments. This flaw can allow an attacker to supply crafted data that is deserialized without proper validation, opening the possibility to execute arbitrary code or compromise the server. The weakness follows CWE-20 (Improper Input Validation) and CWE-502 (Deserialization of Untrusted Data). According to the description, the attack can be initiated remotely, meaning that an external actor could target the server over the network.

Any installation of the ggml-org llama.cpp project that includes the ggml-RPC Server component is potentially affected. No specific release or version range is listed in the advisory, so all current builds that expose this RPC interface should be considered vulnerable until a patched version is available.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, so the current estimated exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalogue. Because the flaw is triggered by crafted RPC input, the attack vector is remote, requiring network connectivity to the server’s RPC endpoint. Successful exploitation would allow an attacker to control the deserialization process and potentially run arbitrary code in the context of the server process.