In this article
  1. What happened
  2. Why it matters
  3. What to do now
  4. Updates

Vulnerability summary

Per the vendor advisory, GitHub advisory GHSA-pmf8-m38j-h768 (CVE-2026-118375): llama.cpp ggml-rpc RDMA out-of-bounds write, checked .

CVE
CVE-2026-118375
Exploited?
Not known. GitHub, VulnCheck and NVD report no attacks, and the flaw is not in CISA's Known Exploited Vulnerabilities catalog as of October 28, 2026. VulnCheck, which assigned the CVE, scores it 9.2 (CVSS 4.0) and 8.1 (CVSS 3.1) in its CVE record; the GitHub advisory shows 9.2 and is not yet reviewed by GitHub.

Who is affected and what fixes it

Who is affected and what fixes it, per the vendor advisory
ProductAffectedFixed inSource
llama.cpp RPC server (ggml-rpc with RDMA transport)b8841 up to but not including b11865b11865llama.cpp release b11865, checked

Patch checklist

  1. Check whether you run the llama.cpp RPC server (ggml-rpc-server, often called rpc-server). It only exists in builds made with GGML_RPC turned on, which is off by default.
  2. If you do, update llama.cpp to release b11865 or later and rebuild, including every machine in your RPC cluster.
  3. Our advice: make sure the RPC server listens only on 127.0.0.1 or a private network, behind a firewall, as the llama.cpp README advises.

If you can't update yet

  • Our advice: stop the RPC server, or firewall its port (50052 by default) so only your own machines can reach it. That lowers the risk; it doesn't fix the flaw.

How to check for compromise

  • Our advice: look for unexplained RPC server crashes or restarts and for unknown processes or files on the host. If the server was reachable from the internet, treat the machine as suspect and rebuild it.

Full steps and context: What to do now

TL;DR: llama.cpp, the open-source engine many teams use to run AI models on their own hardware, has a critical flaw (CVE-2026-118375, GHSA-pmf8-m38j-h768) in its RPC server, the optional component that spreads a model across several machines. It affects releases b8841 up to b11865, and b11865 fixes it. It only matters if you run the RPC server and someone else can reach it on the network. If you do, update and keep that port private.

What happened

On October 27–28, 2026, VulnCheck and GitHub published advisories for CVE-2026-118375 (GitHub’s is GHSA-pmf8-m38j-h768, not yet reviewed by GitHub). The flaw is in the RDMA transport of ggml-rpc, the code behind llama.cpp’s RPC server. VulnCheck, which assigned the CVE, scores it 9.2 out of 10 (CVSS 4.0), and the GitHub advisory shows the same score; VulnCheck’s CVE record also gives 8.1 under the older CVSS 3.1.

According to the advisories, a peer that connects to the RPC server and claims RDMA support during the first handshake can send up to 256 KiB of data into a one-byte variable. That overwrites the server’s memory, which can crash it and may let the attacker run code. No login is needed, the advisories say.

The fix, “rpc : add bounds check in rdma_recv”, was merged on October 24 and shipped in release b11865 on October 25, 2026, at 3:30 a.m. Manila time.

Why it matters

Most people who use llama.cpp never run the RPC server, and this flaw doesn’t touch them. Per llama.cpp’s build files, the RPC server only exists in builds made with GGML_RPC on (it’s off by default), and the RDMA path is built in when RDMA libraries are present, which is typical on servers with fast InfiniBand or RoCE networking and on newer Macs linked over Thunderbolt. It listens on 127.0.0.1 unless you change it.

The risk is a team that set up a multi-machine model cluster, bound the RPC server to all interfaces to make it work, and left it reachable from the office network or the internet. llama.cpp’s own README warns: “Never run the RPC server on an open network or in a sensitive environment!” It’s the same lesson as the recent MLflow CVE-2026-116692 flaw: self-hosted AI servers need the same patching and network rules as any other server.

What to do now

  1. Check whether you run the RPC server. Look for ggml-rpc-server or rpc-server processes on your AI machines. If you only use llama-server, llama-cli or an app that doesn’t start the RPC server, this advisory doesn’t cover your setup.
  2. Update to b11865 or later. Rebuild llama.cpp on every machine in the RPC cluster, servers and client alike.
  3. Keep the port private. Our advice: bind the RPC server to 127.0.0.1 or a private network address, and firewall port 50052 (the default) so only your own machines can reach it.
  4. Look for signs of trouble. Our advice: if the server was reachable from outside, check for crashes and unknown processes, and rebuild the host if anything looks wrong.

Our Security hub tracks other flaws in AI and developer tools.

Updates

  • Oct 28, 2026, 3:07 p.m. Manila: First published. No attacks are reported; we’ll add a dated note if that changes or GitHub revises its advisory.

Sources & method

Sources

Method. Checked October 28, 2026, at 1:15 p.m. Manila time (05:15 UTC). The flaw description, affected and fixed releases and CVSS scores come from the GitHub and VulnCheck advisories; the fix and release dates come from GitHub’s pull request and release data; the default build options and listening address come from llama.cpp’s build files and README at b11865. We checked CISA’s Known Exploited Vulnerabilities catalog. Steps labelled “our advice” are our own judgment, not the llama.cpp project’s. The thumbnail is the social preview image of the llama.cpp GitHub repository. No affiliate links on this page. How we work.

Spotted an error? See our corrections policy and tell us.