NULL pointer dereference in Ggml-Org Llama.cpp
CVE-2026-78148
A vulnerability was determined in ggml-org llama.cpp bec4772f6. This affects the function rpc_server::graph_compute of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Executing a manipulation can lead to null pointer dereference. The attack may be launched remotely. The pull request to fix this issue awaits acceptance.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Ggml-org Llama.cpp — versions bec4772f6
Weakness classification (CWE)
References
- cna@vuldb.com (technical-description, vdb-entry)
- cna@vuldb.com (signature, permissions-required)
- cna@vuldb.com (third-party-advisory)
- cna@vuldb.com (third-party-advisory)
- cna@vuldb.com (issue-tracking)
- cna@vuldb.com (issue-tracking, patch)
- cna@vuldb.com (product)
Frequently asked questions
- What is CVE-2026-78148?
- CVE-2026-78148 is a medium-severity vulnerability in Ggml-Org Llama.cpp, classified under Improper Resource Shutdown or Release. CVSS score: 5.3/10. Published 2026-08-24.
- How severe is CVE-2026-78148?
- Medium severity. CVSS v3 base score is 5.3 out of 10.