External risk intelligence

llama.cpp RDMA Transport Stack Overflow Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-118375

The vulnerability exists in the ggml-rpc RDMA transport component of llama.cpp. RDMA (Remote Direct Memory Access) is a specialized, high-performance networking protocol typically deployed in isolated, high-speed data center fabrics or internal research clusters. It is rarely exposed directly to the public internet, making public network reachability of this specific component uncommon.

Out-of-bounds Write

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the llama.cpp software, specifically within its RDMA transport function. This issue could allow unauthorized external parties to disrupt the server's operation. The main concern is confirming if this technology is in use and, if so, to what extent.

Unauthenticated peers can crash the server.
This affects specialized, high-performance networks.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can target the llama.cpp server by advertising RDMA capabilities in a HELLO message. This allows them to send a large amount of data to a specific function, potentially overflowing a small buffer on the server's stack. This could lead to a server crash or allow the attacker to execute their own code.

No authentication required.
Sending crafted HELLO message.
Server crash or code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in llama.cpp's RDMA transport could allow unauthenticated remote peers to crash the server or potentially execute arbitrary code. The attack is possible when a peer advertises RDMA capabilities and sends a large amount of data to a vulnerable function, overflowing a stack variable. This could lead to a denial-of-service or a compromise of the server.

Server stack and execution flow.
Unauthenticated peer sends malformed RDMA data.
Server crash or arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The vulnerability in llama.cpp's ggml-rpc RDMA transport affects systems using this specific component, likely within specialized data center or cluster environments rather than typical public-facing applications. Initial actions should focus on identifying any deployments of this technology, assessing their business criticality, and locating the accountable system owner before planning remediation.

Identify and confirm affected systems.
Verify RDMA transport reachability and criticality.
Plan targeted remediation or risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is llama.cpp and why does it have an RDMA component?

llama.cpp is a popular software library designed to enable efficient execution of large language models on consumer-grade hardware. The ggml-rpc component facilitates distributed computing, allowing different machines to share processing tasks. The RDMA (Remote Direct Memory Access) transport feature is a specialized networking layer used in high-performance computing to move data directly between memory on different servers, bypassing standard network overhead for faster training or inference.

What does CWE-787 mean regarding CVE-2026-118375?

CWE-787 refers to an Out-of-Bounds Write, a class of software weakness where a program writes data past the intended buffer limits. In the context of this CVE, the ggml-rpc RDMA transport function fails to properly validate the size of incoming data. This allows an attacker to overwrite adjacent areas of the server's stack memory, which can lead to service instability, unexpected crashes, or potentially the unauthorized execution of arbitrary code.

How is this stack overflow triggered?

An attacker triggers this vulnerability by sending a maliciously crafted HELLO message that claims RDMA capabilities to the llama.cpp server. The server then incorrectly processes this request, attempting to write up to 256 KiB of data into a small, 1-byte stack variable. Importantly, this bug only occurs if the RDMA transport functionality is active and reachable; it is not triggered by standard, non-RDMA network communication.

How risky is this for my infrastructure?

According to Halo Surface Signal, this risk is unlikely for most users. Because the vulnerability exists only within the RDMA transport—a high-performance protocol usually confined to isolated, internal data center fabrics or research clusters—it is rarely exposed to the public internet. If your llama.cpp instances operate only on standard network stacks without specialized RDMA configurations, they are not impacted by this specific vector.

What should I do if I use llama.cpp with RDMA?

First, verify whether your llama.cpp deployment explicitly enables and uses the ggml-rpc RDMA transport feature. If it is in use, identify the system owners and assess the criticality of those specific nodes. Your primary goal is to determine if these RDMA-enabled segments are reachable by untrusted peers. Prioritize moving to version b11865 or later, which contains the fix, and restrict network access to the rpc-server as a secondary defensive measure.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.