Tools AI Risk Radar ai-incident-0264
Incident record
llama.cpp fixes an overflow in RDMA server connections
- Severity
- Critical
- Status
- Patched
- Type
- Infra Vuln
- Target
- llama.cpp optional ggml-rpc RDMA transport
- Actor
- Researcher disclosure
- CVE
- CVE-2026-118375
What happened
A peer reaching the optional RDMA transport could overflow a small command buffer and crash the server or potentially execute code. The exposure depends on using that transport.
The CNA records public disclosure on 24 October and published the CVE on 28 October. Its CVSS 4.0 score is 9.2. Builds from b8841 up to, and excluding, b11865 are affected. The public patch request was created on 12 October; the fix merged and b11865 was released on 24 October. The attack requires access to the affected RPC peer connection.
Sources
- Canonical CVE recordraw.githubusercontent.com/CVEProject/cvelistV5/main/cves/202…
- Maintainer patch requestgithub.com/ggml-org/llama.cpp/pull/30399
- Fixed b11865 releasegithub.com/ggml-org/llama.cpp/releases/tag/b11865
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 28 October 2026