Remote Code Execution Vulnerability in llama.cpp by ggml-org
CVE-2026-119052

8.7HIGH

Key Information:

Vendor

Ggml-org

Status
Llama.cpp
Vendor
CVE Published:
29 October 2026

What is CVE-2026-119052?

The llama.cpp product prior to version b11935 contains an uncaught exception vulnerability in its ggml-rpc server. This flaw allows unauthenticated remote attackers to crash the rpc-server by sending oversized message lengths. During the HELLO handshake phase, the attacker can issue a command, such as SET_TENSOR, with a length exceeding std::vector::max_size(). This action triggers an uncaught std::length_error, leading to the abrupt termination of the process and subsequently denying service to all connected clients.

Affected Version(s)

llama.cpp b2877

References

https://github.com/ggml-org/llama.cpp/pull/31204
patchissue-tracking
https://github.com/ggml-org/llama.cpp/commit/7ecb57f7adbe...
patch
https://github.com/ggml-org/llama.cpp
product

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sohaib Harraoui (Ostorlab)
Sohaib Harraoui (Ostorlab)
.