llama.cpp Android CVE-2026-70638

Exploitation requires a user to load a malicious GGUF model file - or receive a crafted JNI call - targeting an Android application compiled against llama.cpp builds b1886 through b7445 with the LLaMA-Android JNI wrapper. The CVSS 4.0 vector specifies AV:L (local attack surface - the malicious file must be on-device and accessible to the application), PR:N (no special privilege level on the Android side is required for exploitation), and UI:P (passive user interaction is required - the user must open or use the app with the malicious model loaded). Exploitation is limited to the Android platform and specifically to applications that have integrated the examples/llama.android binding; the core llama.cpp library on Linux, macOS, or Windows is not confirmed affected by this specific code path. The key limiting factor is the model file delivery: an attacker must convince the user to load a crafted GGUF file, which is plausible in ecosystems where models are routinely downloaded from community repositories but is not a zero-click or network-adjacent attack.

The CVSS 4.0 score of 8.5 with vector AV:L/AC:L/AT:N/PR:N/UI:P reflects a local attack requiring passive user interaction - the user must open or process a malicious GGUF model file - which is a realistic and common action for Android LLM applications where users routinely source models from third parties. The high CIA impact metrics (VC:H/VI:H/VA:H) reflect worst-case RCE within the app process, while SC:N/SI:N/SA:N confirms the scope is contained to the vulnerable application. No EPSS data was provided in the input, so exploitation probability from threat intelligence signals cannot be quantified. The CVE is not listed in CISA KEV, and no POC was referenced, so this should not be treated as actively exploited at time of analysis. Real-world risk is moderate-to-high specifically for Android applications that allow users to load arbitrary GGUF files from untrusted sources; for deployments restricted to vetted, vendor-supplied models, exploitability is substantially reduced. The tags include both DoS and RCE, and reliability of code execution versus crash depends on heap layout - attackers may need additional primitives for reliable RCE beyond the overflow itself.

An attacker crafts a malicious GGUF model file with a deliberately oversized n_seq_max metadata field and distributes it through a third-party model repository, a phishing link, or a compromised model hub. When a user downloads and loads this file into an Android application built on llama.cpp builds b1886-b7445, the new_1batch() function multiplies the oversized n_seq_max by sizeof(llama_seq_id), overflows the integer, and allocates a heap buffer far smaller than required. Subsequent writes into this buffer corrupt adjacent heap metadata, leading to a crash (DoS) or, under controlled heap layout conditions, arbitrary code execution within the app's process - enabling data exfiltration or malware installation on the device.