CVE-2026-118375 llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv()
CriticalCVSS 9.2
EPSS 0.37%
- Published
- Updated
- Exploit status
- No public exploit known
Description
llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB into a 1-byte stack variable in rpc_serve_client(), crashing the server or potentially executing code.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ggml-org llama.cpp | >= b8841, < b11865 | b11865 |
| debian/llama.cpp(Debian:14) | All versions | No fix listed |
| debian/llama.cpp(Debian:14) | = 10108+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 10108+dfsg1-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 10108+dfsg1-2 | No fix listed |
| debian/llama.cpp(Debian:14) | = 10192+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 10192+dfsg-2 | No fix listed |
| debian/llama.cpp(Debian:14) | = 10192+dfsg-2~exp1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 10271+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 10344+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 10438+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 1:0.1.2+dfsg-1~exp1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 1:0.2.0+dfsg1-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 1:0.2.0+dfsg1-1~exp1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 1:0.4.0+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 1:0.4.1+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 1:0.5.0+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 1:0.5.0+dfsg-2 | No fix listed |
| debian/llama.cpp(Debian:14) | = 1:0.6.0+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 1:0.6.0+dfsg-2 | No fix listed |
| debian/llama.cpp(Debian:14) | = 1:0.7.0+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 1:0.7.0+dfsg-2 | No fix listed |
| debian/llama.cpp(Debian:14) | = 5151+dfsg-1~exp2 | No fix listed |
| debian/llama.cpp(Debian:14) | = 5151+dfsg-1~exp3 | No fix listed |
| debian/llama.cpp(Debian:14) | = 5318+dfsg-1 | No fix listed |
Show 42 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/llama.cpp(Debian:14) | = 5318+dfsg-2 | No fix listed |
| debian/llama.cpp(Debian:14) | = 5713+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 5760+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 5760+dfsg-2 | No fix listed |
| debian/llama.cpp(Debian:14) | = 5760+dfsg-3 | No fix listed |
| debian/llama.cpp(Debian:14) | = 5760+dfsg-4 | No fix listed |
| debian/llama.cpp(Debian:14) | = 5882+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 5882+dfsg-2 | No fix listed |
| debian/llama.cpp(Debian:14) | = 5882+dfsg-3 | No fix listed |
| debian/llama.cpp(Debian:14) | = 5882+dfsg-3~exp1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 5882+dfsg-3~exp2 | No fix listed |
| debian/llama.cpp(Debian:14) | = 5882+dfsg-3~exp3 | No fix listed |
| debian/llama.cpp(Debian:14) | = 5882+dfsg-4 | No fix listed |
| debian/llama.cpp(Debian:14) | = 6641+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 6641+dfsg-2 | No fix listed |
| debian/llama.cpp(Debian:14) | = 6641+dfsg-3 | No fix listed |
| debian/llama.cpp(Debian:14) | = 7593+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 7593+dfsg-2 | No fix listed |
| debian/llama.cpp(Debian:14) | = 7593+dfsg-3 | No fix listed |
| debian/llama.cpp(Debian:14) | = 7965+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 8064+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 8064+dfsg-2 | No fix listed |
| debian/llama.cpp(Debian:14) | = 8461+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 8611+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 8681+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 8870+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 8941+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 9009+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 9071+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 9190+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 9413+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 9555+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 9601+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 9721+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 9895+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 9895+dfsg-2 | No fix listed |
| debian/llama.cpp(Debian:14) | = 9895+dfsg-3 | No fix listed |
| debian/llama.cpp(Debian:14) | = 9951+dfsg-1 | No fix listed |
| debian/llama.cpp(Debian:14) | = 9951+dfsg-2 | No fix listed |
| debian/llama.cpp(Debian:14) | = 9951+dfsg-3 | No fix listed |
| ubuntu/llama.cpp(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/llama.cpp(Ubuntu:26.10) | All versions | No fix listed |
References
- Red Hat CVE page mitigation vendor-advisory
- Red Hat Bugzilla 2562543 issue-tracking
- www.cve.org
- nvd.nist.gov
- github.com product
- github.com technical-description
- github.com patch
- github.com issue-tracking patch
- llama.cpp b11865 Release Notes release-notes
- VulnCheck Advisory: llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv() third-party-advisory
- Debian Security Tracker CVE-2026-118375 vendor-advisory
- Ubuntu CVE tracker vendor-advisory