CVE-2026-70638 llama.cpp b1886–b7445 Integer Overflow via new_1batch() in llama-android.cpp

llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new1batch function multiplies sizeofllamaseqid by an attacker-controlled nseqmax parameter without overflow validation, causing heap buffer allocation to wrap and allocate...

CVE-2026-70638 llama.cpp b1886–b7445 Integer Overflow via new_1batch() in llama-android.cpp

llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new1batch function multiplies sizeofllamaseqid by an attacker-controlled nseqmax parameter without overflow validation, causing heap buffer allocation to wrap and allocate...

CVE-2026-43622

CVE-2026-43622 affects llama.cpp builds b1886–b7445, where the LLaMA-Android JNI wrapper presents a double free vulnerability. The code allocates memory with malloc() in new_1batch() but frees it with the C++ delete operator in free_1batch(), leading to heap metadata corruption. Consequences desc...

EUVD-2026-54096

llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new1batch allocates memory using malloc while free1batch deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management...

CVE-2026-43622 llama.cpp b1886–b7445 Double Free via llama-android.cpp

llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new1batch allocates memory using malloc while free1batch deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management...

CVE-2026-43622 llama.cpp b1886–b7445 Double Free via llama-android.cpp

llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new1batch allocates memory using malloc while free1batch deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management...

PT-2026-68795

Name of the Vulnerable Software and Affected Versions llama.cpp versions b1886 through b7445 Description A race condition leads to a use-after-free issue in the LLaMA-Android JNI wrapper. This occurs because the functions bench 1model and free 1context lack proper synchronization, enabling one...

CVE-2026-43622: Mismatched Memory Management Routines

llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new1batch allocates memory using malloc while free1batch deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management...

CVE-2026-70640: NULL Pointer Dereference

llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench1model and free1context lack synchronization, allowing Thread A to operate on freed memory while Thread B concurrently frees the llamacontext. Attackers can explo...

PT-2026-68618

Name of the Vulnerable Software and Affected Versions llama.cpp versions b1886 through b7445 Description A double free issue exists in the LLaMA-Android JNI wrapper. The new 1batch function allocates memory using malloc, but the free 1batch function deallocates it using the C++ delete operator...

PT-2026-68793

Name of the Vulnerable Software and Affected Versions llama.cpp versions b1886 through b7445 Description An integer overflow exists in the LLaMA-Android JNI wrapper. The new 1batch function multiplies the size of llama seq id by the n seq max parameter without validating for overflows. This can...

PT-2026-68794

Name of the Vulnerable Software and Affected Versions llama.cpp builds b1886 through b7445 Description A null pointer dereference occurs in the LLaMA-Android JNI wrapper. The bench 1model function does not validate the model context pointer before dereferencing it. An attacker can provide a...

CVE-2026-70639: NULL Pointer Dereference

llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench1model function fails to validate the model context pointer before dereferencing it. Attackers can supply a malicious, corrupt, or truncated model file to trigger ...

CVE-2026-70638: Integer Overflow or Wraparound

llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new1batch function multiplies sizeofllamaseqid by an attacker-controlled nseqmax parameter without overflow validation, causing heap buffer allocation to wrap and allocate...

CVE-2025-13398

...