CVE-2026-118375
High · 8.1CVSS
8.1
EPSS
0.4%
Published
Oct 28, 2026
CISA due date
—
The record
llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB into a 1-byte stack variable in rpc_serve_client(), crashing the server or potentially executing code.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-78402 Stack-based buffer overflow and out-of-bounds write vulnerability in Thales Sentinel Keys… CWE-787
- CVE-2026-119777 A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. CWE-787
- CVE-2026-104065 Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw… CWE-787
- CVE-2026-104067 Scribus before 1.6.7 contains an out-of-bounds memory access vulnerability in the… CWE-787
- CVE-2026-104066 Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image… CWE-787
- CVE-2026-104061 Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the… CWE-787
- CVE-2026-104062 Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the PICT image… CWE-787
- CVE-2026-61627 libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation… CWE-787