{"id":"CVE-2026-118375","kind":"vulnerability","aliases":["CVE-2026-118375"],"related":[],"title":"llama.cpp RPC server: unauthenticated stack overflow via RDMA transport","description":"llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB into a 1-byte stack variable in rpc_serve_client(), crashing the server or potentially executing code.","summary":"llama.cpp's ggml-rpc RDMA transport writes up to 256 KiB into a 1-byte stack variable in the RPC server. An unauthenticated peer that advertises RDMA in its HELLO message can crash the server or potentially execute code.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","ggml-rpc","llama.cpp","rdma","self-hosted"],"not_affected_if":["default-config","no-rdma","no-rpc-server"],"how_to_check":"- Run `llama-server --version` or check the build tag of the llama.cpp binary; affected builds are from `b8841` up to but not including `b11865`.\n- Check whether the RPC server (`rpc-server`) is running with RDMA support enabled and reachable from untrusted networks.","fix":"- Upgrade llama.cpp to `b11865` or later.\n- Until upgraded, do not expose the `rpc-server` port to untrusted networks or disable RDMA transport.","status":"open","published_at":"2026-10-28T03:17:14+00:00","first_seen_at":"2026-10-28T03:31:02+00:00","triaged_at":"2026-10-28T03:32:18+00:00","updated_at":"2026-10-28T03:32:18+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-28T03:32:18Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade llama.cpp to `b11865` or later.\n- Until upgraded, do not expose the `rpc-server` port to untrusted networks or disable RDMA transport.","reach":"network","title":"llama.cpp RPC server: unauthenticated stack overflow via RDMA transport","impact":"high","summary":"llama.cpp's ggml-rpc RDMA transport writes up to 256 KiB into a 1-byte stack variable in the RPC server. An unauthenticated peer that advertises RDMA in its HELLO message can crash the server or potentially execute code.","category":"ai-tooling","nicknames":[],"who_cares":["llama.cpp","self-hosted","ggml-rpc","rdma"],"confidence":0.6,"needs_auth":"no","worst_case":"Server crashes or attacker runs code on the RPC server host.","analyst_note":"Confirm the exact RDMA enablement condition and whether code execution is demonstrated, using the NVD entry and the upstream llama.cpp advisory.","how_to_check":"- Run `llama-server --version` or check the build tag of the llama.cpp binary; affected builds are from `b8841` up to but not including `b11865`.\n- Check whether the RPC server (`rpc-server`) is running with RDMA support enabled and reachable from untrusted networks.","needs_analyst":true,"not_affected_if":["default-config","no-rpc-server","no-rdma"],"who_is_affected":"Teams running llama.cpp's ggml-rpc RPC server with the RDMA transport, where peers can reach the server over the network. Systems that only run llama.cpp locally, or that do not run the RPC server, are not exposed by this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000649,"input_tokens":3372,"output_tokens":623,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-118375':12A,15A '-2026':11A,14A '1':41B,116C '256':37B,112C 'advertis':53B,101C 'ai':17B 'ai-tool':16B 'allow':90C 'attack':100C 'b11865':70C 'b8841':68C 'bound':76C 'byte':42B,117C 'capabl':103C 'client':123C 'code':66B,130C 'contain':71C 'crash':60B,124C 'cve':10A,13A 'execut':65B,129C 'function':88C 'ggml':20B,30B,82C 'ggml-rpc':19B,29B,81C 'hello':57B,106C 'host':26B 'kib':38B,113C 'llama.cpp':1A,22B,27B,67C 'messag':58B,107C 'out-of-bound':73C 'overflow':6A,94C 'peer':51B,92C 'potenti':64B,128C 'rdma':8A,23B,32B,54B,84C,86C,102C 'recv':87C 'rpc':2A,21B,31B,47B,83C,97C,121C 'rpc-server':96C 'self':25B 'self-host':24B 'send':109C 'serv':122C 'server':3A,48B,62B,98C,126C 'stack':5A,43B,99C,118C 'tool':18B 'transport':9A,33B,85C 'unauthent':4A,50B,91C 'variabl':44B,119C 'via':7A 'vulner':78C 'write':34B,77C","nicknames":[],"mitigations":[],"who_affected":"Teams running llama.cpp's ggml-rpc RPC server with the RDMA transport, where peers can reach the server over the network. Systems that only run llama.cpp locally, or that do not run the RPC server, are not exposed by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T03:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118375","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118375","severity":null,"published_at":"2026-10-28T03:17:14+00:00","modified_at":"2026-10-28T03:17:14+00:00","first_seen_at":"2026-10-28T03:31:02+00:00","fetched_at":"2026-10-28T03:31:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}