CVE-2026-118375 — Vulnerability intelligence
ggml-org — llama.cpp
Published:
- CVSS
- 9.2
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB into a 1-byte stack variable in rpc_serve_client(), crashing the server or potentially executing code.