llama.cpp: Stack-based buffer overflow in ggml-rpc RDMA transport
Summary
llama.cpp versions from b8841 up to, but not including, b11865 contain an out-of-bounds write in the RDMA transport of the ggml-rpc backend (rdma_recv()). An unauthenticated peer that advertises RDMA capabilities in the HELLO message can send up to 256 KiB into a 1-byte stack variable of the RPC server, which crashes the server and may allow code execution. Exploitation requires that the RPC server with RDMA support is running and reachable by a peer.
Affected
- llama.cpp b8841 up to, but not including, b11865
- Default configuration: unaffected (per CNA record)
- Whether RDMA support is compiled in by default and whether the RPC server listens on all interfaces: Unknown.
Fixed in
- llama.cpp b11865 (fix in commit 9a0fde9, PR #30399)
Workaround
- No workaround documented by the sources. Upgrading is the remedy.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof of concept found for this CVE.
- Metasploit, Exploit-DB and nuclei entries: not confirmed.
Our recommendation
- Inventory all llama.cpp instances, including containers, Python bindings and desktop tools.
- Upgrade to llama.cpp b11865 or later, and check downstream packages such as llama-cpp-python.
- If an RPC server cannot be upgraded immediately, restrict its port to trusted hosts only using a firewall or network segmentation.
- Monitor RPC server logs for crashes or unexpected connections.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- llama.cpp release b11865 github.com
- Fix commit 9a0fde9 github.com
- Fix pull request #30399 github.com
- Vulnerable code transport.cpp github.com
- Ubuntu CVE tracker ubuntu.com
- NVD mirror record vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:56.
Original description (NVD)
llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB into a 1-byte stack variable in rpc_serve_client(), crashing the server or potentially executing code.
NVD references (6)
- https://github.com/ggml-org/llama.cpp
- https://github.com/ggml-org/llama.cpp/blob/620d2225cc436ab0b001e3200e590e3b286ef9ab/ggml/src/ggml-rpc/transpo…
- https://github.com/ggml-org/llama.cpp/commit/9a0fde9967fa1a35b6e5dd1f47e1a3648b6fecc1
- https://github.com/ggml-org/llama.cpp/pull/30399
- https://github.com/ggml-org/llama.cpp/releases/tag/b11865
- https://www.vulncheck.com/advisories/llama-cpp-b8841-before-b11865-stack-based-buffer-overflow-via-ggml-rpc-r…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.