llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv()
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in b11865
- Public exploit
- None on Exploit-DB
Summary
The llama.cpp inference software, specifically its RPC server component that uses RDMA transport, is affected. An unauthenticated remote attacker can send oversized data that overflows a stack buffer, which can crash the server or potentially allow arbitrary code execution.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB into a 1-byte stack variable in rpc_serve_client(), crashing the server or potentially executing code.
Affected versions
- ggml-org llama.cpp
From b8841 · fixed in b11865