CVE-2026-78148: ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp graph_compute null pointer dereference
A vulnerability was determined in ggml-org llama.cpp bec4772f6. This affects the function rpcserver::graphcompute of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Executing a manipulation can lead to null pointer dereference. The attack may be launched remotely. The pull request to fix this issue awaits acceptance.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments running the ggml-RPC Server component in ggml-org llama.cpp are exposed. The affected code is rpc_server::graph_compute in ggml/src/ggml-rpc/ggml-rpc.cpp.
What does an attacker need to exploit it?
The issue can be attacked remotely and requires no privileges or user interaction according to the supplied severity vector. Exploitation involves manipulating input in a way that triggers a null pointer dereference.
What is the likely impact of successful exploitation?
The provided vector indicates an availability impact only, with no stated confidentiality or integrity impact. A successful null pointer dereference may cause the affected service to fail or become unavailable.
Is a fix available?
A pull request to fix the issue exists but was awaiting acceptance at the time of the provided information. No accepted fix version is identified.