What happened
VulDB/NVD published CVE-2026-78147 on 2026-08-23/24, describing a deserialization vulnerability in llama.cpp's ggml-RPC server that manipulates op/op_params to abuse the underlying computation graph processing, following closely on the heels of a separate critical RPC use-after-free (CVE-2026-39909, CVSS 9.2) disclosed in the same component on 2026-08-21.
Why it matters
This is the second serious remotely-triggerable memory-safety/deserialization issue disclosed in llama.cpp's RPC server within the same week, indicating the distributed-inference RPC surface remains an active and incompletely-hardened attack target in one of the most widely deployed open-source LLM inference engines.
Attack vector
The deserialize_tensor function in ggml/src/ggml-rpc/ggml-rpc.cpp fails to validate the op and op_params arguments before processing them in the RPC server's computational graph engine, allowing a remote attacker with access to the RPC interface to inject malicious operation parameters. This is explicitly distinct from the related CVE-2026-34159 (which only added a null-buffer check) and represents an incomplete-fix follow-on in the same attack surface as CVE-2026-39909, a critical use-after-free RCE disclosed days earlier in the same RPC component.
Affected systems
ggml-org llama.cpp, ggml-RPC Server component (commit bec4772f6 and related versions)
Mitigation
Track the ggml-org/llama.cpp repository for a patch addressing op/op_params validation in deserialize_tensor; until fixed, do not expose the RPC server to untrusted networks and restrict access via firewall/allow-list or VPN.