llama.cpp ggml RPC server: unvalidated tensor op and op_params in deserialize_tensor

Impact

ggml's rpc-server deserializes tensors straight off the wire from any client that can reach its port, and deserialize_tensor() does not validate the op or op_params fields, so a crafted request drives the GPU backend with attacker-chosen operation state. The record characterises this as unsafe deserialization and does not demonstrate code execution, so the floor is a remote crash of the backend worker with memory-safety risk above that. It is explicitly distinct from CVE-2026-34159, whose fix only added a buffer==nullptr rejection in create_node() and left op/op_params unchecked - so a fleet that took that patch is still exposed. rpc-server is typically deployed to pool GPUs across hosts and listens on the cluster network with no authentication of its own, which means anything that can route to the port can drive the GPU worker directly.

Who can reach it

Network, unauthenticated. Anyone who can reach the ggml rpc-server listening port - which has no authentication layer - can send the crafted tensor. No credentials, no tenant account, no local access needed.

What to do

The record names no fixed release: the upstream issue was closed automatically for inactivity and no patch is referenced. Treat rpc-server as a trusted-network-only component - bind it to loopback or a private interface, and firewall or NetworkPolicy the port so only the coordinating process can reach it, never tenant-reachable networks. Restarting the worker clears a crash but does not remove the bug, so this is mitigate-only until an upstream fix lands.

References

Related entries

• llama.cpp ggml RPC server: null pointer dereference in graph_compute kills the GPU workerCVE-2026-78148 · llama.cpp ggml RPC server (rpc_server::graph_compute)Medium
• BentoML: SSRF filter misses 100.64.0.0/10, so serving pods fetch from internal CGNAT hostsCVE-2026-78205 · BentoML make_safe_connect (SSRF address filter, RFC 6598 range)Medium
• ONNX: symlink-following external-data write lets a local attacker append to victim-writable filesCVE-2026-49114 · ONNX Python library (save_external_data external-data path handling)Medium
• Hugging Face Transformers: checkpoint index shard names traverse out of the model directoryCVE-2026-75104 · Hugging Face Transformers (checkpoint shard index filename handling)Medium
• Ollama: DNS rebinding grants a remote page full API accessCVE-2024-28224 · OllamaMedium
• Dagster (gRPC `get_notebook_data`): Local file inclusion — read arbitrary filesCVE-2025-51481 · Dagster (gRPC `get_notebook_data`)Medium