CVE-2026-119052

llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc server that allows unauthenticated remote attackers to crash the rpc-server by sending oversized message lengths. After the HELLO handshake, attackers can send a command such as SET TENSOR with a length above std::vector::max size(), triggering an uncaught std::length error that aborts the process and denies service to all clients.