Stack-based Buffer Overflow in llama.cpp from ggml-org
CVE-2026-118375

9.2CRITICAL

Key Information:

Vendor

Ggml-org

Status
Llama.cpp
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118375?

The llama.cpp library prior to version b11865 contains a vulnerability in the ggml-rpc RDMA transport rdma_recv() function, which leads to an out-of-bounds write. This flaw allows unauthenticated attackers to exploit the rpc-server stack by sending excessively large data (up to 256 KiB) into a single-byte stack variable in the rpc_serve_client() function. Successful exploitation may result in server crashes or remote code execution, posing significant risks to affected implementations.

Affected Version(s)

llama.cpp b8841

References

https://github.com/ggml-org/llama.cpp/pull/30399
patchissue-tracking
https://github.com/ggml-org/llama.cpp/commit/9a0fde9967fa...
patch
https://github.com/ggml-org/llama.cpp/blob/620d2225cc436a...
technical-description

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sohaib Harraoui (Ostorlab)
Sohaib Harraoui (Ostorlab)
.