Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-118375: llama.cpp can be crashed or hijacked by remote users

CVE-2026-118375 · published 8 days ago

Summary

Versions of llama.cpp between the indicated revisions have a flaw in the network code that lets an unauthenticated remote system send special data and overwrite memory on the server. This can cause the server to stop working or let an attacker run their own code. Upgrade to the fixed version or apply the vendor's patch as soon as possible.

What to do

Update ggml-org llama.cpp to version b11865 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	ggml-org	llama.cpp	< b11865
Debian:14	debian	llama.cpp	All versions
Ubuntu:26.10	canonical	llama.cpp	All versions

Original advisory text

llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv()

llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB into a 1-byte stack variable in rpc_serve_client(), crashing the server or potentially executing code.

References

https://github.com/ggml-org/llama.cpp/pull/30399 Patch
https://github.com/ggml-org/llama.cpp Product
https://github.com/ggml-org/llama.cpp/releases/tag/b11865 Vendor Advisory
https://www.vulncheck.com/advisories/llama-cpp-b8841-before-b11865-stack-based-b... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-118375 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-1183... Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2026-118375 Vendor Advisory
https://ubuntu.com/security/CVE-2026-118375 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-118375 Third Party Advisory
https://github.com/ggml-org/llama.cpp/blob/620d2225cc436ab0b001e3200e590e3b286ef... Third Party Advisory
https://github.com/ggml-org/llama.cpp/commit/9a0fde9967fa1a35b6e5dd1f47e1a3648b6... Patch

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.9 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-787Out-of-bounds Write

Timeline

Published28 Oct 2026

Updated4 Nov 2026

First seen28 Oct 2026

Sources

CVE-2026-118375 · NVD

CVE-2026-118375 · MITRE

CVE-2026-118375 · OSV

DEBIAN-CVE-2026-118375 · OSV

UBUNTU-CVE-2026-118375 · OSV

Track software like this

Free during beta