CVE-2026-43628

llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dryallowedlength set to INT32MIN to the /v1/completions or...

CVE-2026-43628 llama.cpp b3978–b9058 Integer Underflow via DRY Sampler

llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dryallowedlength set to INT32MIN to the /v1/completions or...

CVE-2026-43628 llama.cpp b3978–b9058 Integer Underflow via DRY Sampler

llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dryallowedlength set to INT32MIN to the /v1/completions or...

CVE-2026-43628

llama.cpp builds b3978–b9058 are affected by an integer underflow and out-of-bounds read in the DRY sampler. A crafted HTTP request with dry_allowed_length = INT32_MIN to /v1/completions or /v1/chat/completions can trigger a heap buffer underflow, enabling unauthenticated attackers to crash the s...

CVE-2026-43627

llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llamabatchinit function where unchecked multiplications in malloc calls can wrap past INT32MAX when computing allocation sizes. Attackers can pass specially crafted parameters to trigger integer overflow, causin...

CVE-2026-43627 llama.cpp b1283–b9058 Integer Overflow in llama_batch_init() Function

llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llamabatchinit function where unchecked multiplications in malloc calls can wrap past INT32MAX when computing allocation sizes. Attackers can pass specially crafted parameters to trigger integer overflow, causin...

CVE-2026-70640

llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench1model and free1context lack synchronization, allowing Thread A to operate on freed memory while Thread B concurrently frees the llamacontext. Attackers can explo...

CVE-2026-70640

llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench1model and free1context lack synchronization, allowing Thread A to operate on freed memory while Thread B concurrently frees the llamacontext. Attackers can explo...

CVE-2026-70640 llama.cpp b1886–b7445 Race Condition Use-After-Free via llama-android.cpp

llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench1model and free1context lack synchronization, allowing Thread A to operate on freed memory while Thread B concurrently frees the llamacontext. Attackers can explo...

CVE-2026-70640

llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench1model and free1context lack synchronization, allowing Thread A to operate on freed memory while Thread B concurrently frees the llamacontext. Attackers can explo...

CVE-2026-70640 llama.cpp b1886–b7445 Race Condition Use-After-Free via llama-android.cpp

llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench1model and free1context lack synchronization, allowing Thread A to operate on freed memory while Thread B concurrently frees the llamacontext. Attackers can explo...

CVE-2026-70640 llama.cpp b1886–b7445 Race Condition Use-After-Free via llama-android.cpp

llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench1model and free1context lack synchronization, allowing Thread A to operate on freed memory while Thread B concurrently frees the llamacontext. Attackers can explo...

CVE-2026-70640

The CVE-2026-70640 issue affects llama.cpp builds b1886–b7445, with a race condition in the LLaMA-Android JNI wrapper: bench_1model() and free_1context() lack synchronization, allowing a thread to operate on freed llama_context memory. Attackers could perform heap spray using attacker-controlled ...

CVE-2026-70639

llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench1model function fails to validate the model context pointer before dereferencing it. Attackers can supply a malicious, corrupt, or truncated model file to trigger ...

CVE-2026-70639

llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench1model function fails to validate the model context pointer before dereferencing it. Attackers can supply a malicious, corrupt, or truncated model file to trigger ...

CVE-2026-70639 llama.cpp b1886–b7445 Null Pointer Dereference DoS via llama-android.cpp

llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench1model function fails to validate the model context pointer before dereferencing it. Attackers can supply a malicious, corrupt, or truncated model file to trigger ...

CVE-2026-70639 llama.cpp b1886–b7445 Null Pointer Dereference DoS via llama-android.cpp

llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench1model function fails to validate the model context pointer before dereferencing it. Attackers can supply a malicious, corrupt, or truncated model file to trigger ...

CVE-2026-70639

CVE-2026-70639 affects llama.cpp builds b1886–b7445, specifically the LLaMA-Android JNI wrapper. The vulnerability arises because bench_1model() does not validate the model context pointer before dereferencing it, causing a null pointer dereference. An attacker can supply a malformed, corrupt, or...

CVE-2026-70638

llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new1batch function multiplies sizeofllamaseqid by an attacker-controlled nseqmax parameter without overflow validation, causing heap buffer allocation to wrap and allocate...

CVE-2026-70638

llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new1batch function multiplies sizeofllamaseqid by an attacker-controlled nseqmax parameter without overflow validation, causing heap buffer allocation to wrap and allocate...