Two llama.cpp RPC CVEs, One With No Fix in Tree

Two llama.cpp CVEs Landed, But One Fix Is Still Unmerged

The RPC server takes a function pointer off the socket. The more serious of the two has no fix in the tree at all.

Aug 24, 2026Source: NVD

Two vulnerabilities in llama.cpp's ggml-RPC server published to the national vulnerability database within an hour of each other overnight on 23-24 August. Both are in the same component. Neither has a fix in the shipping tree.

The serious one

CVE-2026-78147, published 23 August at 23:16 UTC, is in the deserialize_tensor function. The server reads op and op_params off the wire without validating them. For a custom operation, that structure contains a function pointer — which then gets called. The database is explicit that this is distinct from an earlier CVE, which added only a buffer check and did not validate the operation fields. The RPC server needs no authentication.

The second one, and its 41-day fix

CVE-2026-78148, published 24 August at 00:16 UTC, is a null pointer dereference in rpc_server::graph_compute, remotely triggerable. It is the milder of the two, and it is the one with a fix — a pull request opened on 14 July that was still unmerged when the CVE published 41 days later.

What the common framing gets wrong

These will be reported as "medium severity" because that is the badge attached to both. That badge follows the newer CVSS 4.0 scale, which puts both at 6.9 — the identical score for a remote controlled indirect call and a null-pointer crash, which should itself invite suspicion. On the older CVSS 3.1 scale the same assessor separates them properly: 7.3, in the high band, for the function-pointer issue and 5.3 for the crash. The scores are not in conflict; they are different scales, and the one being surfaced happens to be the one that flattens the distinction.

The part that is not about scoring

The issue behind the more serious CVE was reported on 3 July and closed on 18 August with the reason not_planned — an inactivity auto-close, five days before the vulnerability was published. Neither of these was an unknown flaw. Both were in the tracker, and the tracker moved on.

Why It Matters

llama.cpp's RPC server is widely deployed for distributed local inference, often on the assumption that a trusted network is protection enough — and the more exploitable of these two has no patch to apply.