The vulnerability is a null pointer dereference in the rpc_server::graph_compute function of ggml-org llama.cpp's ggml-RPC Server component. When an attacker sends a crafted request to this RPC endpoint, the function attempts to dereference a null pointer, causing the process to crash. This crash results in a denial of service for clients that rely on the server, as the service becomes unavailable until restarted.

All installations of ggml-org llama.cpp that contain the current, unpatched ggml-RPC Server code are affected. The advisory does not list specific version numbers, so any release prior to the acceptance of pull request #25670 is likely vulnerable.

The CVSS score of 6.9 indicates a moderate severity, and the EPSS score is unavailable, suggesting no known or scheduled exploits. The attack can be launched remotely through the RPC interface, but no publicly available exploit exists. The lack of KEV listing further indicates that the vulnerability is not yet targeted in known exploited vulnerabilities. Nonetheless, the potential for service disruption remains because a null pointer dereference can crash the server without additional privileges.