501716 matches found
CVE-2026-70640 llama.cpp b1886–b7445 Race Condition Use-After-Free via llama-android.cpp
llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench1model and free1context lack synchronization, allowing Thread A to operate on freed memory while Thread B concurrently frees the llamacontext. Attackers can explo...
CVE-2026-70640 llama.cpp b1886–b7445 Race Condition Use-After-Free via llama-android.cpp
llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench1model and free1context lack synchronization, allowing Thread A to operate on freed memory while Thread B concurrently frees the llamacontext. Attackers can explo...
CVE-2026-70640
The CVE-2026-70640 issue affects llama.cpp builds b1886–b7445, with a race condition in the LLaMA-Android JNI wrapper: bench_1model() and free_1context() lack synchronization, allowing a thread to operate on freed llama_context memory. Attackers could perform heap spray using attacker-controlled ...
CVE-2026-70640
llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench1model and free1context lack synchronization, allowing Thread A to operate on freed memory while Thread B concurrently frees the llamacontext. Attackers can explo...
CVE-2026-70640 llama.cpp b1886–b7445 Race Condition Use-After-Free via llama-android.cpp
llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench1model and free1context lack synchronization, allowing Thread A to operate on freed memory while Thread B concurrently frees the llamacontext. Attackers can explo...
CVE-2026-70638
CVE-2026-70638 affects the llama.cpp project, specifically the LLaMA-Android JNI wrapper. Versions b1886–b7445 are vulnerable due to an integer overflow in new_1batch(), which multiplies sizeof(llama_seq_id) by an attacker-controlled n_seq_max without overflow validation, causing the heap allocat...
CVE-2026-70638
llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new1batch function multiplies sizeofllamaseqid by an attacker-controlled nseqmax parameter without overflow validation, causing heap buffer allocation to wrap and allocate...
CVE-2026-70638 llama.cpp b1886–b7445 Integer Overflow via new_1batch() in llama-android.cpp
llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new1batch function multiplies sizeofllamaseqid by an attacker-controlled nseqmax parameter without overflow validation, causing heap buffer allocation to wrap and allocate...
CVE-2026-43622 llama.cpp b1886–b7445 Double Free via llama-android.cpp
llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new1batch allocates memory using malloc while free1batch deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management...
EUVD-2026-54096
llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new1batch allocates memory using malloc while free1batch deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management...
CVE-2026-43622
CVE-2026-43622 affects llama.cpp builds b1886–b7445, where the LLaMA-Android JNI wrapper presents a double free vulnerability. The code allocates memory with malloc() in new_1batch() but frees it with the C++ delete operator in free_1batch(), leading to heap metadata corruption. Consequences desc...
CVE-2026-43622 llama.cpp b1886–b7445 Double Free via llama-android.cpp
llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new1batch allocates memory using malloc while free1batch deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management...
CVE-2026-43622 llama.cpp b1886–b7445 Double Free via llama-android.cpp
llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new1batch allocates memory using malloc while free1batch deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management...
CVE-2026-67261
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the...
CVE-2026-66709
Shop manager Remote Code Execution RCE in CTX Feed = 6.6.42 versions...
CVE-2026-65553
Unauthenticated Remote Code Execution RCE in Spider Analyser WordPress搜索引擎蜘蛛分析插件 = 2.1.3 versions...
CVE-2026-65548
Contributor Remote Code Execution RCE in Betheme = 28.4.2 versions...
CVE-2026-53975
OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn without any allowlist, blocklist, or...
libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode
A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing LAP mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when glaginframes is set to 1 or higher. This results in a 232-byte...
libaom: libaom: arbitrary address write via SVC layer context OOB and cyclic refresh map pointer hijack
An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC Scalable Video Coding layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel value...