llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv() (CVE-2026-118375)

Why this deserves its current priority

CVSS is 9.2. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps ggml-org/llama.cpp (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
ggml-org/llama.cppgeneric	>=b8841 <b11865	b11865

Recommended response

Check inventory. Check lockfiles and deployed manifests for ggml-org/llama.cpp.
Review the reported fix. Update ggml-org/llama.cpp to b11865 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Oct 28, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Oct 28, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Oct 28, 2026

Sources and claim methodology

Upstream source description

llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB into a 1-byte stack variable in rpc_serve_client(), crashing the server or potentially executing code.

Quoted source text, attributed separately from HOL analysis.

llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv()CVE-2026-118375

Key facts