{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/llama.cpp--b11865/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ggml-org:llama.cpp:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-118375"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["llama.cpp (\u003c b11865)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["ggml-org"],"content_html":"\u003cp\u003eA stack-based buffer overflow exists in the \u003ccode\u003erdma_recv()\u003c/code\u003e function of the \u003ccode\u003eggml-rpc\u003c/code\u003e RDMA transport in \u003ccode\u003ellama.cpp\u003c/code\u003e versions prior to b11865. The vulnerability occurs because the \u003ccode\u003erpc_serve_client()\u003c/code\u003e function fails to safely handle data when an attacker advertises RDMA capabilities within a crafted HELLO message. An unauthenticated remote attacker can overflow a 1-byte stack variable with up to 256 KiB of data, leading to a service crash or potential remote code execution.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthenticated remote code execution in the context of the \u003ccode\u003ellama.cpp\u003c/code\u003e service, or service denial via application crash.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch \u003ccode\u003ellama.cpp\u003c/code\u003e by updating to version b11865 or later immediately.\u003c/li\u003e\n\u003cli\u003eDisable RDMA capabilities for the \u003ccode\u003eggml-rpc\u003c/code\u003e service if network transport is not required in your environment.\u003c/li\u003e\n\u003cli\u003eAudit network logs for connections to the \u003ccode\u003ellama.cpp\u003c/code\u003e RPC port originating from untrusted network segments.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-28T04:39:18Z","date_published":"2026-10-28T04:39:18Z","id":"https://feed.craftedsignal.io/briefs/2026-10-llama-cpp-overflow/","summary":"An unauthenticated stack-based buffer overflow vulnerability in the ggml-rpc RDMA transport of llama.cpp versions prior to b11865 allows remote code execution via a malicious RDMA HELLO message.","title":"llama.cpp: Unauthenticated remote code execution in ggml-rpc RDMA transport (CVE-2026-118375)","url":"https://feed.craftedsignal.io/briefs/2026-10-llama-cpp-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - Llama.cpp (\u003c B11865)","version":"https://jsonfeed.org/version/1.1"}