{"schema":"threatline.record/2","record":{"id":"CVE-2026-118375","aliases":[],"summary":"llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv()","details":"llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB into a 1-byte stack variable in rpc_serve_client(), crashing the server or potentially executing code.","categories":["Unclassified"],"product":"llama.cpp","vendor":"ggml-org","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-118375","source_modified_at":"2026-10-28T02:03:22.895Z","fetched_at":"2026-10-28T08:18:35.509402Z","product":"llama.cpp","vendor":"ggml-org","versions":[{"version":"b8841","status":"affected","versionType":"custom","lessThan":"b11865"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":9.2,"severity":"Critical","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T02:03:22.895Z","modified_at":"2026-10-28T02:03:22.895Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-118375","fetched_at":"2026-10-28T08:18:35.509402Z","source_modified_at":"2026-10-28T02:03:22.895Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/ggml-org/llama.cpp/pull/30399","tags":["patch","issue-tracking"]},{"source":"CVE List","url":"https://github.com/ggml-org/llama.cpp/commit/9a0fde9967fa1a35b6e5dd1f47e1a3648b6fecc1","tags":["patch"]},{"source":"CVE List","url":"https://github.com/ggml-org/llama.cpp/blob/620d2225cc436ab0b001e3200e590e3b286ef9ab/ggml/src/ggml-rpc/transport.cpp#L510-L528","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/ggml-org/llama.cpp/releases/tag/b11865","tags":["release-notes"]},{"source":"CVE List","url":"https://github.com/ggml-org/llama.cpp","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/llama-cpp-b8841-before-b11865-stack-based-buffer-overflow-via-ggml-rpc-rdma-rdma-recv","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-28T02:03:22.895Z","content_hash":"169095a6902a69bd180246e7b3ef099d0624687e4e72be2e50387f0cfc896658"}}