Executive brief
llama.cpp is a C/C++ library used for running large language models locally. The ggml-RPC server feature accepts tensor data from remote clients without validation, allowing an unauthenticated attacker to hijack program control flow and execute arbitrary code by supplying a malicious custom operation with a crafted function pointer.
Technical details
A deserialization vulnerability exists in the deserialize_tensor() function of ggml-rpc.cpp (ggml-RPC Server component). The function copies tensor metadata—including the operation type (op) and operation parameters (op_params)—directly from network input without validation. For custom operation types (GGML_OP_CUSTOM, GGML_OP_MAP_CUSTOM1/2/3), op_params is cast to a structure containing a function pointer and userdata. When the computation graph is evaluated, ggml_compute_forward_custom() dereferences and calls this attacker-supplied function pointer with attacker-controlled arguments. The attack requires network access to the default RPC port (TCP 50052) and no authentication; the tensor must have the GGML_TENSOR_FLAG_COMPUTE flag set to trigger evaluation. This is a CWE-502 (deserialization) and CWE-749 (improper control of interaction frequency) vulnerability that enables arbitrary code execution. No patch is currently available.
Affected products
- ggml-org llama.cpp commit bec4772f6 and latest master as of July 2026
Timeline
- 2026-07-03: disclosed: Issue #25289 opened on GitHub
- 2026-08-23: advisory: CVE-2026-78147 published
- 2026-07: other: Issue closed as not planned due to inactivity