VulnFeed.org: ggml-org llama.cpphttps://vulnfeed.org/Every disclosure, as it lands. Critical-only feed available.enCVE-2026-118375: llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv()https://vulnfeed.org/cve/CVE-2026-118375/https://vulnfeed.org/cve/CVE-2026-118375/Wed, 28 Oct 2026 03:17:14 +0000llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB into a 1-byte stack variable in rpc_serve_client(), crashing the server or potentially executing code.CVE-2026-116816: llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizerhttps://vulnfeed.org/cve/CVE-2026-116816/https://vulnfeed.org/cve/CVE-2026-116816/Tue, 27 Oct 2026 01:19:06 +0000llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability in llm_tokenizer_plamo2::build that allows attackers to corrupt heap memory via crafted GGUF models. Attackers can supply BYTE-typed token text like <0x-1> whose negative parsed value writes token ids before the bytes_ buffer during model loading, causing crashes or potential code execution.