llama.cpp EUVD-2026-111551

Exploitation requires the target to be an llama.cpp rpc-server built/running with the ggml-rpc RDMA transport active, and the server network-reachable to the attacker. The concrete trigger per the description: a peer advertises RDMA capabilities in the HELLO message, after which the server's rdma_recv() path accepts up to 256 KiB that overflows a 1-byte stack variable in rpc_serve_client(). No authentication is required (CVSS PR:N), so any reachable peer qualifies. The key limiting factor is deployment mode: the llama.cpp RPC server is an opt-in distributed-inference feature and the RDMA transport is a specific, non-default path (reflected by AT:P), so hosts that do not run the rpc-server or do not enable RDMA are not exposed. No user interaction is needed (UI:N).

The input CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) scores 9.2 (Critical) and the vuln.today Decision label is act_now, so this should be treated as an urgent, patch-now item wherever the affected component is exposed. The strongest signals are AV:N with PR:N - a network-reachable, unauthenticated peer can trigger the flaw - combined with high confidentiality/integrity/availability impact consistent with a stack out-of-bounds write (CWE-787) that the description says crashes the server or could 'potentially' execute code. The AT:P metric (Attack Requirements: Present) is important context: exploitation is not against a bare default, it requires the rpc-server to be running the ggml-rpc RDMA transport path, which the attacker then engages by advertising RDMA in the HELLO message. Signals are only partially complete: no EPSS probability and no CISA KEV entry are provided, so there is no evidence of active or widespread exploitation - exploitation status is 'no public exploit identified at time of analysis' (the references are patches, source, and a VulnCheck advisory, not exploit code). This means the 9.2 is a genuine severity ceiling rather than a demonstrated mass-exploitation threat: the realistic risk concentrates on operators who run network-exposed llama.cpp RPC servers with RDMA enabled. Code execution is described as a possibility ('potentially'), not a confirmed capability, so confirmed impact is at minimum denial of service via server crash.

An attacker with network reach to an llama.cpp rpc-server that is running the ggml-rpc RDMA transport connects as an unauthenticated peer and advertises RDMA capabilities in its HELLO message. It then sends up to 256 KiB of data that the vulnerable rdma_recv() path writes into a 1-byte stack variable in rpc_serve_client(), overflowing the stack and crashing the server, with potential for code execution. No public exploit code was identified in the provided data; the fix PR confirms the missing bounds check.