CVE-2026-78147

Name of the Vulnerable Software and Affected Versions llama.cpp version bec4772f6

Description A deserialization flaw exists in the ggml-RPC Server component. A remote attacker can trigger this issue by manipulating the op or op params arguments within the deserialize tensor() function located in the ggml/src/ggml-rpc/ggml-rpc.cpp file. Deserialization is the process of converting a data format (like a byte stream) back into an object that the program can use.

Recommendations As a temporary mitigation, restrict access to the ggml-RPC Server or avoid using the deserialize tensor() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.