CVE-2026-118375

llama.cpp RDMA transport can overflow the RPC server stack

ggml-org · llama.cpp ggml-rpc RDMA transport

First documented disclosure · Review checkpoint

Summary

An oversized RDMA completion can overwrite a small RPC command buffer.

Severity and exploitation evidence

Critical · 9.2/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed sources establish a vulnerability or controlled demonstration, not malicious exploitation against a victim. Exact-ID lookup found no entry in CISA KEV catalog 2026.10.27; absence does not prove no exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

rdma_recv copies the completion length without checking remaining destination capacity.

Conditions required

An unauthenticated peer reaches an RPC server with the RDMA transport available and negotiates the affected path.

Potential impact

Server crash and potential code execution; the public local ASan test demonstrated a stack overflow.

Affected versions and configurations

llama.cpp >=b8841, <b11865.

Fix and mitigation status

b11865.

Practical next steps

Update to a release containing the bounds check and restrict RPC/RDMA peers to trusted systems.

Operating lesson

Transport-level length checks must match the caller’s actual buffer size.

Evidence and limits

The public fix PR opened October 12 and merged October 24; CVE publication was October 28. The CNA rates 9.2 under CVSS 4.0 with attack requirements present. No successful malicious campaign is established.

Sources