llama.cpp Android CVE-2026-70639

Exploitation requires the following specific conditions: (1) the target application uses the llama.cpp Android JNI wrapper and invokes the bench_1model() benchmarking function - applications that use only inference paths and never call bench_1model() are not affected; (2) the attacker can deliver a malformed, corrupt, or truncated GGUF model file to the Android device's accessible storage; (3) the user must interact to load the malicious model (CVSS UI:P confirms this requirement). The attack vector is local (AV:L), meaning remote-only adversaries without a file delivery mechanism cannot exploit this directly. No authentication is required (PR:N) once file delivery is achieved. Exploitation is strictly bounded to denial-of-service - the CVSS vector explicitly confirms no confidentiality (VC:N) or integrity (VI:N) impact. Applications that validate model file integrity (e.g., checksum verification or source whitelisting) before passing to the JNI layer are not practically exploitable even on unpatched builds.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) scores 6.8, reflecting a local attack requiring user interaction with no confidentiality or integrity impact - only high availability impact to the vulnerable system. The local attack vector (AV:L) is the dominant limiting factor: the attacker must deliver a crafted GGUF file to the Android device and induce the user to load it into an application that calls bench_1model(). No EPSS score was provided in the source data, so exploitation probability cannot be quantified. The vulnerability is not in CISA KEV and no POC has been identified, consistent with a low-to-moderate real-world exploitation priority. The blast radius is narrow - a single Android application crash with no lateral movement potential or data exposure. This is a genuine DoS risk for applications that accept model files from untrusted sources but is unlikely to be prioritized over network-exploitable or authenticated-bypass vulnerabilities in most enterprise triage workflows.

An attacker crafts a malformed GGUF model file designed to cause context initialization failure in llama.cpp and social-engineers a user into loading it via an Android application that uses the llama.cpp JNI wrapper with benchmarking enabled. When bench_1model() is called with the corrupt model, the null context pointer is dereferenced in native code, generating a SIGSEGV that the Android OS uses to kill the application process. No public exploit code has been identified at time of analysis, but the mechanics are straightforward for any developer familiar with GGUF format structure.