CVE-2026-78148
Received Received - Intake

Null Pointer Dereference in Llama.cpp RPC Server

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulDB

Description
A vulnerability was determined in ggml-org llama.cpp bec4772f6. This affects the function rpc_server::graph_compute of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Executing a manipulation can lead to null pointer dereference. The attack may be launched remotely. The pull request to fix this issue awaits acceptance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-78148
EUVD
EUVD-2026-64672

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ggml-org llama.cpp to bec4772f6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a remote unauthenticated NULL-pointer dereference in the ggml-rpc server component of the llama.cpp project. It occurs in the graph_compute() function when a crafted GRAPH_COMPUTE message with a node ID of 0 is sent. The server incorrectly treats node ID 0 as valid, leading to a NULL pointer being dereferenced during graph planning. This causes a segmentation fault (SIGSEGV) and crashes the server.

Detection Guidance

Monitor for crashes in the ggml-rpc server process, specifically SIGSEGV errors on x86_64 Linux systems. Check for unexpected network traffic on the ggml-rpc port with tools like netstat or ss. Inspect logs for segmentation faults in the llama.cpp application.

Impact Analysis

This vulnerability allows an attacker to remotely crash the ggml-rpc server by sending a minimal 20-byte message. The crash can disrupt services relying on the RPC server, potentially causing downtime or denial of service. Since the attack requires no authentication, any exposed RPC server is at risk.

Compliance Impact

The vulnerability causes a remote crash via null pointer dereference in the ggml-rpc server, which could lead to denial of service. This may impact compliance by disrupting availability of systems handling sensitive data under GDPR or HIPAA, potentially violating availability requirements.

Mitigation Strategies

Apply the patch from pull request #25670 which adds validation to reject invalid node IDs in graph_compute(). Alternatively, disable the ggml-rpc server component if not required. Implement network-level controls to restrict access to the ggml-rpc port.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78148. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart