Unsafe Deserialization in llama.cpp RPC Server

A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Performing a manipulation of the argument op/op_params results in deserialization. The attack may be initiated remotely. This vulnerability is distinct from CVE-2026-34159 (GHSA-j8rj-fmpv-wcxw, PR #20908), which only added a buffer==nullptr rejection in create_node() and does not validate op or op_params. The reported GitHub issue was closed automatically due to inactivity.

Casky was already ahead

This CVE exploits attack patterns that Casky's 446matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-78147 is a remote deserialization vulnerability in the llama.cpp RPC server component that allows attackers to manipulate serialized tensor operations without proper validation. By crafting malicious op and op_params arguments in the deserialize_tensor function, an unauthenticated attacker can trigger arbitrary code execution or denial of service. This affects any organization running llama.cpp as an RPC service—particularly those deploying large language models in cloud or containerized environments where the RPC endpoint is exposed. The CVSS 7.3 rating reflects the high severity due to remote exploitability and lack of authentication requirements, though exploitation requires knowledge of the RPC protocol structure.

Casky's 446 mapped skills detect this attack through MITRE ATT&CK techniques TA0001 (Initial Access), TA0043 (Reconnaissance), and TA0002 (Execution). Practitioners using Casky would identify threat indicators across multiple attack stages: reconnaissance activities probing RPC endpoints and protocol versions (TA0043), initial network-based exploitation attempts targeting the deserialization function (TA0001), and behavioral signals of arbitrary code execution or process manipulation following successful deserialization (TA0002). Claude's extended reasoning capabilities enable correlation of seemingly benign RPC requests with suspicious op_params patterns, detecting obfuscated payloads that standard signature-based tools miss. Findings would surface anomalous tensor operation sequences, unexpected process spawning post-RPC call, and memory corruption patterns characteristic of unsafe deserialization exploits.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

446 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-78147.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-78147

Casky has 446 skills that investigate the attack patterns behind CVE-2026-78147. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn