by Kastro
Paper/Archive/CVE-2026-118375

CVE-2026-118375

ggml-org llama.cpp — llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv()

EPSS 0.4%CVSS 9.2
critical.is priorityof 100
34
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 30.6.306 × 206.1No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB into a 1-byte stack variable in rpc_serve_client(), crashing the server or potentially executing code.

Affected

ProductAffectedFixed inSource
llama.cppb8841 – < b11865b11865CNA

Scores by source

VulnCheck (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
VulnCheck (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

patchgithub.com/ggml-org/llama.cpp/pull/30399patchgithub.com/ggml-org/llama.cpp/commit/9a0fde9967fa1a35b6e5dd1f47e1a3648b6fecc1writeupgithub.com/ggml-org/llama.cpp/blob/620d2225cc436ab0b001e3200e590e3b286ef9ab/ggml/src/ggml-rpc/transport.cpp#L510-L528refgithub.com/ggml-org/llama.cpp/releases/tag/b11865refgithub.com/ggml-org/llama.cppwriteupvulncheck.com/advisories/llama-cpp-b8841-before-b11865-stack-based-buffer-overflow-via-ggml-rpc-rdma-rdma-recv