CVE-2026-78147: llama.cpp ggml-RPC Server RCE Vulnerability

CVE-2026-78147 is a deserialization remote code execution flaw in llama.cpp ggml-RPC Server affecting the deserialize_tensor function. Attackers can exploit this by manipulating op or op_params arguments. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-78147 Overview

CVE-2026-78147 is an insecure deserialization vulnerability in the ggml-org/llama.cpp project at commit bec4772f6. The flaw resides in the deserialize_tensor function inside ggml/src/ggml-rpc/ggml-rpc.cpp, part of the ggml-RPC Server component. An unauthenticated remote attacker can manipulate the op and op_params arguments during tensor deserialization to trigger unsafe behavior. This issue is distinct from CVE-2026-34159, which added a buffer==nullptr rejection in create_node() but did not validate op or op_params. The associated GitHub issue was closed automatically due to inactivity, meaning no upstream fix is currently linked.

Critical Impact
Remote attackers can send crafted RPC messages to the ggml-RPC Server to exploit unvalidated deserialization of tensor operation parameters, affecting confidentiality, integrity, and availability of the inference host.

Affected Products

ggml-org/llama.cpp at commit bec4772f6
ggml-RPC Server component (ggml/src/ggml-rpc/ggml-rpc.cpp)
Deployments exposing the llama.cpp RPC endpoint over the network

Discovery Timeline

2026-08-23 - CVE-2026-78147 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-78147

Vulnerability Analysis

The vulnerability is an Improper Input Validation issue [CWE-20] leading to insecure deserialization. The deserialize_tensor routine in the ggml-RPC Server reconstructs tensor objects from network-supplied buffers. During this process, the op field, which selects a ggml operation, and the op_params array, which supplies operation parameters, are consumed without validation against expected ranges or types.

An attacker who can reach the RPC listener supplies a serialized tensor with attacker-controlled op and op_params values. Downstream code paths then act on these values as if they were trusted, producing out-of-contract behavior in the inference pipeline. The prior patch tracked as CVE-2026-34159 only rejected null buffers in create_node() and left the operation metadata path unguarded.

Root Cause

The root cause is the absence of bounds and type checks on deserialized fields. The RPC server trusts that op corresponds to a defined ggml_op enum value and that op_params conforms to the shape expected by that operation. Neither assumption is enforced at the deserialization boundary.

Attack Vector

Exploitation requires network reach to the ggml-RPC Server. No authentication or user interaction is required. The attacker crafts an RPC request that carries a malformed tensor descriptor with out-of-range op values or oversized op_params, then submits it to the listening endpoint. See the GitHub issue #25289 and the VulDB entry for CVE-2026-78147 for further technical context.

No verified proof-of-concept code is published. Refer to the linked GitHub
issue and VulDB references for the current technical description of the
deserialization path in ggml-rpc.cpp.

Detection Methods for CVE-2026-78147

Indicators of Compromise

Unexpected inbound connections to the llama.cpp RPC listener port from untrusted networks or hosts.
ggml-RPC Server process crashes, restarts, or abnormal memory growth correlated with RPC traffic.
RPC message payloads containing op values outside the defined ggml_op enumeration range.
Anomalously large or malformed op_params arrays in captured RPC traffic.

Detection Strategies

Inspect network flows to identify hosts exposing the ggml-RPC Server outside of expected inference clusters.
Instrument the RPC server with logging of received op and op_params values to flag out-of-range inputs.
Correlate process instability of llama.cpp binaries with recent inbound RPC sessions.

Monitoring Recommendations

Alert on new listeners bound to RPC ports on hosts running llama.cpp builds at or near commit bec4772f6.
Monitor egress from inference hosts for signs of post-exploitation activity such as unexpected outbound sessions.
Track child processes and file writes originating from the llama.cpp RPC service.

How to Mitigate CVE-2026-78147

Immediate Actions Required

Remove the ggml-RPC Server from any network segment reachable by untrusted clients.
Restrict the RPC listener to loopback or to explicitly allow-listed peers using host firewalls.
Audit deployments for the affected commit bec4772f6 and comparable builds that include the ggml-rpc component.

Patch Information

No vendor patch is linked in the NVD record at the time of publication. The prior related fix, CVE-2026-34159, added a buffer==nullptr check in create_node() but does not validate op or op_params. Track the llama.cpp repository and GitHub issue #25289 for a corrective commit that enforces validation inside deserialize_tensor.

Workarounds

Disable the ggml-RPC Server if the RPC feature is not required for your workload.
Place the RPC endpoint behind a mutually authenticated TLS tunnel or VPN and reject anonymous callers.
Apply an upstream or local patch that validates op against the ggml_op enum and bounds-checks op_params before use.

bash

# Example: restrict the llama.cpp RPC port (default 50052) to localhost only
sudo iptables -A INPUT -p tcp --dport 50052 ! -s 127.0.0.1 -j DROP
sudo iptables -A INPUT -p tcp --dport 50052 -s 127.0.0.1 -j ACCEPT