---
id: "CVE-2026-118375"
kind: "vulnerability"
aliases: ["CVE-2026-118375"]
title: "llama.cpp RPC server: unauthenticated stack overflow via RDMA transport"
severity: "critical"
cvss: 9.2
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "ggml-rpc", "llama.cpp", "rdma", "self-hosted"]
not_affected_if: ["default-config", "no-rdma", "no-rpc-server"]
published_at: "2026-10-28T03:17:14+00:00"
first_seen_at: "2026-10-28T03:31:02+00:00"
updated_at: "2026-10-28T03:32:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118375", "first_seen_at": "2026-10-28T03:31:02+00:00"}]
---

# llama.cpp RPC server: unauthenticated stack overflow via RDMA transport

llama.cpp's ggml-rpc RDMA transport writes up to 256 KiB into a 1-byte stack variable in the RPC server. An unauthenticated peer that advertises RDMA in its HELLO message can crash the server or potentially execute code.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `llama-server --version` or check the build tag of the llama.cpp binary; affected builds are from `b8841` up to but not including `b11865`.
- Check whether the RPC server (`rpc-server`) is running with RDMA support enabled and reachable from untrusted networks.

## Fix

- Upgrade llama.cpp to `b11865` or later.
- Until upgraded, do not expose the `rpc-server` port to untrusted networks or disable RDMA transport.

## Timeline

- 2026-10-28T03:31:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118375

## From the sources

llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB into a 1-byte stack variable in rpc_serve_client(), crashing the server or potentially executing code.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_