501855 matches found
CVE-2026-43629 llama.cpp b4882–b9058 Buffer Overflow in KV Cache State Restore
llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore path where the statereaddata function computes write size without overflow checking, allowing attackers with write access to the slotsavepath directory to corrupt heap memory. Attackers...
CVE-2026-43627 llama.cpp b1283–b9058 Integer Overflow in llama_batch_init() Function
llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llamabatchinit function where unchecked multiplications in malloc calls can wrap past INT32MAX when computing allocation sizes. Attackers can pass specially crafted parameters to trigger integer overflow, causin...
CVE-2026-43627
The CVE-2026-43627 issue affects llama.cpp (b1283–b9058) in the llama_batch_init() function, where unchecked multiplications in malloc() cause allocation sizes to wrap past INT32_MAX. This leads to heap corruption and can potentially enable arbitrary code execution through subsequent batch operat...
CVE-2026-70640 llama.cpp b1886–b7445 Race Condition Use-After-Free via llama-android.cpp
llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench1model and free1context lack synchronization, allowing Thread A to operate on freed memory while Thread B concurrently frees the llamacontext. Attackers can explo...
CVE-2026-70640 llama.cpp b1886–b7445 Race Condition Use-After-Free via llama-android.cpp
llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench1model and free1context lack synchronization, allowing Thread A to operate on freed memory while Thread B concurrently frees the llamacontext. Attackers can explo...
CVE-2026-70640
llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench1model and free1context lack synchronization, allowing Thread A to operate on freed memory while Thread B concurrently frees the llamacontext. Attackers can explo...
CVE-2026-70640
The CVE-2026-70640 issue affects llama.cpp builds b1886–b7445, with a race condition in the LLaMA-Android JNI wrapper: bench_1model() and free_1context() lack synchronization, allowing a thread to operate on freed llama_context memory. Attackers could perform heap spray using attacker-controlled ...
CVE-2026-70640 llama.cpp b1886–b7445 Race Condition Use-After-Free via llama-android.cpp
llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench1model and free1context lack synchronization, allowing Thread A to operate on freed memory while Thread B concurrently frees the llamacontext. Attackers can explo...
CVE-2026-70638
llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new1batch function multiplies sizeofllamaseqid by an attacker-controlled nseqmax parameter without overflow validation, causing heap buffer allocation to wrap and allocate...
CVE-2026-70638
CVE-2026-70638 affects the llama.cpp project, specifically the LLaMA-Android JNI wrapper. Versions b1886–b7445 are vulnerable due to an integer overflow in new_1batch(), which multiplies sizeof(llama_seq_id) by an attacker-controlled n_seq_max without overflow validation, causing the heap allocat...
CVE-2026-70638 llama.cpp b1886–b7445 Integer Overflow via new_1batch() in llama-android.cpp
llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new1batch function multiplies sizeofllamaseqid by an attacker-controlled nseqmax parameter without overflow validation, causing heap buffer allocation to wrap and allocate...
CVE-2026-43622 llama.cpp b1886–b7445 Double Free via llama-android.cpp
llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new1batch allocates memory using malloc while free1batch deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management...
EUVD-2026-54096
llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new1batch allocates memory using malloc while free1batch deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management...
CVE-2026-43622 llama.cpp b1886–b7445 Double Free via llama-android.cpp
llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new1batch allocates memory using malloc while free1batch deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management...
CVE-2026-43622
CVE-2026-43622 affects llama.cpp builds b1886–b7445, where the LLaMA-Android JNI wrapper presents a double free vulnerability. The code allocates memory with malloc() in new_1batch() but frees it with the C++ delete operator in free_1batch(), leading to heap metadata corruption. Consequences desc...
CVE-2026-43622 llama.cpp b1886–b7445 Double Free via llama-android.cpp
llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new1batch allocates memory using malloc while free1batch deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management...
CVE-2026-67261
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the...
CVE-2026-66709
Shop manager Remote Code Execution RCE in CTX Feed = 6.6.42 versions...