llama.cpp EUVD-2026-54096

Exploitation requires the target Android application to use llama.cpp builds b1886 through b7445 and to invoke the LLaMA-Android JNI wrapper's batch allocation lifecycle through the new_1batch() and free_1batch() functions. The CVSS 4.0 UI:P metric indicates the victim must take an action - likely launching the app or initiating an inference session - to trigger the vulnerable code path. The AV:L (local) vector limits exploitation to the local device context; network-based remote triggering is not indicated by available data. Arbitrary code execution beyond a reliable crash is further conditioned on favorable allocator state, which varies by Android version and device model. Exploitation is bounded by: the requirement for an Android application specifically using the JNI wrapper (not desktop or server llama.cpp builds), the build range b1886-b7445, and the necessity of reaching the batch allocation path via attacker-influenced input. Non-Android deployments of llama.cpp are not affected by this specific vulnerability.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, score 8.5) indicates a local attack surface with low complexity, no privileges required, but user interaction present - meaning exploitation requires an end user to run an Android application that exercises the vulnerable JNI batch allocation path. The high impact ratings (VC:H/VI:H/VA:H) reflect the theoretical ceiling of arbitrary code execution; in practice, reliable heap exploitation beyond a process crash depends on allocator internals and heap layout, which vary significantly across Android versions and devices. No EPSS probability score was provided in the available intelligence, so quantitative exploitation likelihood cannot be stated. The vulnerability is not listed in CISA KEV and no confirmed public proof-of-concept exploit has been identified, meaningfully reducing near-term real-world risk. The local attack vector further constrains the attacker population to those who can influence input within the device context. Overall this is a medium operational priority: a real, well-characterized vulnerability with credible RCE potential capped by local-only access, absence of known active exploitation, and availability of a vendor-released fix.

An attacker who can supply a crafted prompt or model interaction to an Android application embedding the vulnerable llama.cpp JNI wrapper triggers the new_1batch() and free_1batch() call sequence, causing the C++ delete operator to corrupt heap metadata set up by malloc(). Depending on the Android runtime heap layout and allocator state, this results in a reliable process crash (denial of service) or, with controlled heap grooming, could be leveraged for code execution within the application's sandbox. No public proof-of-concept exploit has been confirmed at time of analysis.