CVE-2026-78148
Description
A flaw was found in the ggml-RPC Server component of llama.cpp. A remote attacker can exploit this vulnerability by performing a specific manipulation, leading to a null pointer dereference. This can result in a Denial of Service (DoS), making the affected system unavailable.
Statement
Red Hat Product Security has determined that this vulnerability affects the ggml-RPC Server component of llama.cpp, which is an optional feature that requires explicit build-time enablement (GGML_RPC=ON) and operator action to start the ggml-rpc-server binary. The vulnerability does not affect the core llama.cpp library or typical usage patterns of Python bindings (llama-cpp-python) or Rust bindings (llama-cpp-2) that are bundled in Red Hat products.
Most Red Hat products that include llama.cpp dependencies (RHEL AI containers, goose package) bundle only the inference library bindings and do not build, ship, or expose the vulnerable RPC server component. These products are not affected by this vulnerability.
The impact is rated Moderate with CVSS score 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) because exploitation requires the optional RPC server to be explicitly enabled and running, and results only in denial of service of that server process, not the broader system. The low availability impact (A:L) reflects that this affects an opt-in feature rather than a critical system component.
Mitigation
For systems where the ggml-RPC Server is required and actively used:
1. Restrict network access to the RPC server port (default TCP 1234) using firewall rules to trusted clients only
2. Do not expose the ggml-rpc-server to untrusted networks or the public internet
3. Consider using SSH tunneling or VPN for remote RPC access
4. Monitor for and restart crashed RPC server processes until a patched version is available
For most Red Hat product deployments that use llama.cpp only through Python or Rust bindings, no mitigation is required as the vulnerable component is not included.
The upstream fix is available in GitHub pull request #25670 (https://github.com/ggml-org/llama.cpp/pull/25670). Update to a version containing this fix when available.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | 5.3 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/RC:R
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart
NULL pointer dereferences usually result in the failure of the process unless exception handling (on some platforms) is available and implemented. Even when exception handling is being used, it can still be very difficult to return the software to a safe state of operation.
Integrity,Confidentiality
Technical Impact: Execute Unauthorized Code or Commands; Read Memory; Modify Memory
In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
