CVE-2026-78147

A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Performing a manipulation of the argument op/op_params results in deserialization. The attack may be initiated remotely. This vulnerability is distinct from CVE-2026-34159 (GHSA-j8rj-fmpv-wcxw, PR #20908), which only added a buffer==nullptr rejection in create_node() and does not validate op or op_params. The reported GitHub issue was closed automatically due to inactivity.

• CWE-20
• CWE-502

• https://github.com/ggml-org/llama.cpp/
• https://github.com/ggml-org/llama.cpp/issues/25289
• https://vuldb.com/cve/CVE-2026-78147
• https://vuldb.com/submit/882534
• https://vuldb.com/vuln/394534
• https://vuldb.com/vuln/394534/cti

Published

Aug 23, 2026

Last Modified

Oct 12, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-78141A vulnerability has been found in Tenda CH22 1.0.0.1. This a…7.4
• CVE-2026-78142A vulnerability was found in code-projects Barangay Resident…6.3
• CVE-2026-78143A vulnerability was determined in code-projects Barangay Res…7.3
• CVE-2026-78144A vulnerability was identified in code-projects Barangay Res…6.3
• CVE-2026-78145A vulnerability has been found in CTFd up to 3.8.4. The affe…4.3
• CVE-2026-78146The Simple Newsletter Plugin WordPress plugin before 4.3.3 …6.5
• CVE-2026-78148A vulnerability was determined in ggml-org llama.cpp bec4772…5.3
• CVE-2026-78149The Smart Post WordPress plugin before 4.0.8 does not check…5.3
• CVE-2026-7815SQL injection vulnerability in pgAdmin 4 Maintenance Tool. …8.8
• CVE-2026-78150The Smart Post WordPress plugin before 4.0.8 does not check…2.7
• CVE-2026-78151The FormLayer WordPress plugin before 1.0.9 does not perform…5.3
• CVE-2026-78152The SureRank SEO WordPress plugin before 1.10.1 does not ex…5.3