CVE-2026-78148: llama.cpp RCE Vulnerability

CVE-2026-78148 Overview

CVE-2026-78148 is a null pointer dereference vulnerability in the ggml-org/llama.cpp project, commit bec4772f6. The flaw resides in the rpc_server::graph_compute function within ggml/src/ggml-rpc/ggml-rpc.cpp, part of the ggml-RPC Server component. A remote attacker can trigger the dereference by sending crafted input to the RPC server, causing the process to crash. The issue is tracked under CWE-404: Improper Resource Shutdown or Release. A pull request addressing the flaw is pending upstream acceptance.

Critical Impact
Remote, unauthenticated attackers can crash the llama.cpp RPC server, disrupting availability of inference services exposed over the network.

Affected Products

ggml-org llama.cpp at commit bec4772f6
ggml-RPC Server component (ggml/src/ggml-rpc/ggml-rpc.cpp)
Deployments exposing the llama.cpp RPC interface over the network

Discovery Timeline

2026-08-24 - CVE-2026-78148 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-78148

Vulnerability Analysis

The vulnerability affects the rpc_server::graph_compute function in llama.cpp's RPC server implementation. When the RPC server processes a graph compute request, it dereferences a pointer that has not been validated as non-null. An attacker who can reach the RPC listener sends a crafted request that drives the code path into the unchecked dereference, causing a segmentation fault.

The llama.cpp RPC server is designed to distribute inference workloads across networked backends. Because the listener accepts remote connections without requiring authentication in typical deployments, the attack surface extends to any host that can reach the service port. Exploitation results in loss of availability for the affected process. Confidentiality and integrity are not impacted, per the published CVSS vector.

A fix has been proposed upstream in GitHub Pull Request #25670, tracked against Issue #25299. The patch is awaiting maintainer acceptance at time of publication.

Root Cause

The root cause is missing input or state validation in rpc_server::graph_compute before a pointer dereference. The function assumes the referenced object is initialized and non-null, but attacker-controlled RPC payloads can drive execution into a state where the pointer remains null. This maps to CWE-404, improper resource shutdown or release.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a malformed or unexpected request to the llama.cpp RPC server endpoint. The server invokes graph_compute, hits the null pointer dereference, and terminates. Repeated requests sustain a denial-of-service condition against the inference service.

No public proof-of-concept is currently listed, and the flaw is not present in CISA's Known Exploited Vulnerabilities catalog. Refer to VulDB entry for CVE-2026-78148 and the llama.cpp repository for ongoing technical discussion.

Detection Methods for CVE-2026-78148

Indicators of Compromise

Unexpected termination or crash of the llama.cpp RPC server process with a segmentation fault signature
Core dumps referencing rpc_server::graph_compute in the call stack
Inbound connections to the RPC server port from unexpected or untrusted sources

Detection Strategies

Monitor process supervisor logs (systemd, container runtime, Kubernetes) for repeated restarts of llama.cpp RPC workers
Enable core dump collection and inspect stack traces for frames inside ggml/src/ggml-rpc/ggml-rpc.cpp
Deploy network telemetry to flag anomalous or high-frequency traffic to the RPC listener port

Monitoring Recommendations

Alert on crash-loop patterns for llama.cpp services and correlate with source IPs of preceding RPC requests
Log all connections to the RPC endpoint and baseline expected client hosts for deviation detection
Track ggml-org/llama.cpp releases and merge status of Pull Request #25670 to time patch deployment

How to Mitigate CVE-2026-78148

Immediate Actions Required

Restrict network access to the llama.cpp RPC listener using firewall rules, security groups, or host-level ACLs
Bind the RPC server to loopback or a private management interface rather than a public interface
Do not expose the RPC port to untrusted networks until the upstream fix is merged and deployed

Patch Information

A fix is proposed in GitHub Pull Request #25670 against the tracking Issue #25299. The pull request is awaiting acceptance. Once merged, rebuild llama.cpp from a commit that includes the fix and redeploy affected RPC server binaries. Track upstream progress through the ggml-org/llama.cpp repository.

Workarounds

Place the RPC listener behind an authenticated reverse proxy or VPN to prevent unauthenticated remote access
Run the RPC server under a process supervisor configured to rate-limit restart attempts and alert on repeated crashes
Disable the ggml RPC server component in deployments that do not require distributed backend inference

bash

# Configuration example: restrict llama.cpp RPC to localhost and firewall the port
# 1. Start the server bound to loopback only
./rpc-server --host 127.0.0.1 --port 50052

# 2. Block external access to the RPC port with iptables
iptables -A INPUT -p tcp --dport 50052 ! -s 127.0.0.1 -j DROP