CVE-2026-78148 is a null pointer dereference vulnerability in the function rpc_server::graph_compute within the file ggml/src/ggml-rpc/ggml-rpc.cpp of the ggml-RPC Server component in the ggml-org llama.cpp project. This flaw can be exploited remotely by manipulating inputs to cause the server to dereference a null pointer, leading to a denial of service condition. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts availability only. A pull request containing a fix is pending acceptance, indicating no official patch is currently available.

Successful exploitation results in a denial of service via null pointer dereference, causing the affected service to crash or become unavailable. There is no impact on confidentiality or integrity according to the CVSS vector. The attack can be launched remotely without authentication or user interaction.

No official patch or fix is currently available as the pull request to address the issue awaits acceptance. Users should monitor the ggml-org llama.cpp project repository or vendor advisories for the official fix and apply it promptly once released. Until then, consider limiting exposure of the ggml-RPC Server to untrusted networks to reduce risk.