CVE-2026-86317

MediumCVSS 5.3/10Last modified Sep 8, 2026

Description

A vulnerability was detected in ggml-org llama.cpp up to 0.4.0. This impacts the function rpc_server::deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component RPC Server. Performing a manipulation of the argument ne results in reachable assertion. The attack is possible to be carried out remotely. The reported GitHub issue was closed automatically due to inactivity.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-617

Affected software

No affected versions have been published.

Timeline

Published: Sep 7, 2026
Last modified: Sep 8, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-863185.3A flaw has been found in java-json-tools json-patch up to 1.13. Affected is the function JsonMergePatch.fromJson of the file JsonMergePatchD CVE-2026-863195.3A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of t CVE-2026-86327.8A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vulnerability may allow CVE-2026-863207.8A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can CVE-2026-863215.3A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this issue is the function JsonLoader.fromURL of the file sr CVE-2026-863259.4A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insuff CVE-2026-863268.6An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify th CVE-2026-86339.8IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Appli CVE-2026-863307.2An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_internal_api. This component is responsible CVE-2026-863326.5A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes CVE-2026-863344.2Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on CVE-2026-863356.3Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to acces