EUVD-2026-54096
GHSA-54rv-j2gm-hqfc
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector and required user interaction to trigger JNI batch path; PR:N as no privilege elevation needed to invoke JNI functions; full C/I/A if heap grooming succeeds.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1batch() allocates memory using malloc() while free_1batch() deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management mismatch to cause denial of service through process crashes or potentially achieve arbitrary code execution depending on allocator state.
AnalysisAI
Heap corruption via mismatched memory management in llama.cpp's LLaMA-Android JNI wrapper affects builds b1886 through b7445, where new_1batch() allocates memory with malloc() but free_1batch() releases it using the C++ delete operator, triggering undefined behavior and heap metadata corruption. This mismatch guarantees denial of service via process crash and, depending on allocator state, may enable arbitrary code execution within the affected Android application process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target Android application to use llama.cpp builds b1886 through b7445 and to invoke the LLaMA-Android JNI wrapper's batch allocation lifecycle through the new_1batch() and free_1batch() functions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, score 8.5) indicates a local attack surface with low complexity, no privileges required, but user interaction present - meaning exploitation requires an end user to run an Android application that exercises the vulnerable JNI batch allocation path. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can supply a crafted prompt or model interaction to an Android application embedding the vulnerable llama.cpp JNI wrapper triggers the new_1batch() and free_1batch() call sequence, causing the C++ delete operator to corrupt heap metadata set up by malloc(). Depending on the Android runtime heap layout and allocator state, this results in a reliable process crash (denial of service) or, with controlled heap grooming, could be leveraged for code execution within the application's sandbox. … |
| Remediation | Upgrade to llama.cpp build b7446 or later, available at https://github.com/ggml-org/llama.cpp/releases/tag/b7446. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Android applications and development environments currently running llama.cpp builds b1886 through b7445 to quantify exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary memory write in llama.cpp's RPC server allows remote unauthenticated attackers to corrupt arbitrary memory add
Remote code execution in llama.cpp (commit 18c2e17) is possible when a user opens a malicious .gguf model file, triggeri
Remote code execution in llama.cpp (commit 18c2e17) is possible when a victim loads a malicious .gguf model file, trigge
Remote code execution in llama.cpp (GGUF library) allows attackers to achieve arbitrary code execution by tricking a use
Remote code execution in llama.cpp (commit 18c2e17) occurs when the GGUF library's gguf_fread_str function parses a mali
Heap-based buffer overflow in llama.cpp's GGUF library header parser (commit 18c2e17) enables code execution when a vict
Remote code execution in llama.cpp RPC backend allows unauthenticated attackers with TCP access to achieve arbitrary mem
llama.cpp provides LLM inference in C/C++. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable,
Remote code execution in llama.cpp (ggml-org) prior to build b8585 arises from a use-after-free in the RPC server's GRAP
Llama.cpp is LLM inference in C/C++. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no auth
Remote code execution in llama.cpp prior to commit b7824 is possible through a crafted GGUF file that exploits an intege
Local attackers can achieve heap buffer overflow in llama.cpp versions before b8146 through integer overflow in the GGUF
Same weakness CWE-762 – Mismatched Memory Management Routines
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today