Description

A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Performing a manipulation of the argument op/op_params results in deserialization. The attack may be initiated remotely. This vulnerability is distinct from CVE-2026-34159 (GHSA-j8rj-fmpv-wcxw, PR #20908), which only added a buffer==nullptr rejection in create_node() and does not validate op or op_params. The reported GitHub issue was closed automatically due to inactivity.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-23T23:16:46.243Z",
  "pubdate": "2026-08-23T23:16:46.243Z",
  "executiveSummary": "A deserialization vulnerability has been identified in the ggml-RPC Server component of ggml-org llama.cpp at commit bec4772f6. The security flaw specifically resides within the deserialize_tensor function located in ggml/src/ggml-rpc/ggml-rpc.cpp. Successful exploitation of this vulnerability arises from the direct manipulation of the op or op_params arguments during the tensor deserialization process. This security defect enables a remote attacker to initiate attacks over the network without requiring prior authentication or specific privileges, posing severe risk implications to systems exposing the RPC server interface. The vulnerability allows for untrusted data processing, which can potentially lead to arbitrary code execution, memory corruption, or complete denial of service of the affected RPC server instance. This issue is distinctly separate from CVE-2026-34159 (GHSA-j8rj-fmpv-wcxw, PR #20908), which merely introduced a buffer==nullptr check in create_node() and failed to implement adequate validation checks on the op or op_params parameters. Consequently, systems running vulnerable builds of the ggml-RPC Server remain exposed to remote input manipulation attacks targeting the underlying RPC communication channel.",
  "technicalDetails": "The vulnerability is rooted in insecure deserialization practices within the ggml-RPC Server component of llama.cpp, specifically inside the deserialize_tensor function within ggml/src/ggml-rpc/ggml-rpc.cpp at commit bec4772f6. The root cause of the flaw is the absence of rigorous input validation and sanitization on critical parsing arguments, namely op and op_params, when handling incoming network payloads. During standard remote procedure call operations, the server receives serialized tensor structures that must be reconstructed into memory. The vulnerable function processes these input streams and extracts operational parameters without confirming their structural integrity, bounds, or expected types.\nThe attack flow initiates when a remote, unauthenticated attacker crafts a malicious network payload containing manipulated op or op_params values. This payload is transmitted directly to the exposed ggml-RPC Server over the network protocol utilized by the RPC mechanism. Upon receipt, the server passes the untrusted byte stream to the deserialize_tensor function. Because the function lacks sufficient verification logic to validate the op and op_params fields against safe boundaries or expected schemas, the malicious input is parsed and instantiated within the server's memory space.\nThis behavior deviates from prior partial hardening efforts such as CVE-2026-34159 (GHSA-j8rj-fmpv-wcxw, PR #20908), which exclusively addressed null pointer dereference conditions by adding a buffer==nullptr check in create_node(), entirely omitting checks for malicious or malformed operation parameters. Exploitation of this deserialization flaw can lead to severe post-exploitation impacts, including memory corruption, arbitrary code execution within the context of the running RPC server process, or application crashes resulting in a persistent denial of service. The network exposure of the ggml-RPC Server combined with the lack of authentication and privilege requirements significantly lowers the barrier for exploitation by remote threat actors."
}