EUVD-2026-54278
GHSA-6xfh-c5w2-8vqf
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local delivery of crafted model file required (AV:L); user must load the file (UI:R); no authentication needed (PR:N); impact is application crash only, no data exposure (C:N/I:N/A:H).
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
3DescriptionCVE.org
llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench_1model() function fails to validate the model context pointer before dereferencing it. Attackers can supply a malicious, corrupt, or truncated model file to trigger a null context condition, causing a SIGSEGV crash that terminates the Android application process and results in denial of service.
AnalysisAI
Null pointer dereference in the llama.cpp LLaMA-Android JNI wrapper's bench_1model() function allows denial of service via a crafted model file. Builds b1886 through b7445 (packaged releases 0.9.0-0.17.1) are affected; the function skips null validation on the model context pointer before dereferencing it, so supplying a malformed or truncated GGUF model file triggers a SIGSEGV that terminates the Android application process. No public exploit has been identified at time of analysis and this is not listed in CISA KEV, but the attack path is mechanically simple for anyone able to deliver a crafted model to the device.
Technical ContextAI
llama.cpp exposes native C++ LLM inference to Android applications through a JNI (Java Native Interface) bridge in the examples/llama.android directory. The bench_1model() function performs model benchmarking within this native layer but omits a null guard on the model context pointer returned from context initialization. When GGUF model loading fails - due to corruption, truncation, or deliberate malformation - the initialization returns null, and the subsequent dereference in bench_1model() raises a SIGSEGV, which the Android OS delivers as an unhandled signal that terminates the process. CWE-476 (NULL Pointer Dereference) identifies this as a missing precondition check at a trust boundary between user-supplied model data and native code. The EUVD-2026-54278 entry corroborates the affected build range b1886-b7445 and the corresponding semantic version range 0.9.0-0.17.1.
RemediationAI
Upgrade to llama.cpp build b7446 or later, available at https://github.com/ggml-org/llama.cpp/releases/tag/b7446 - this is the vendor-released patched build. The upstream fix commit is https://github.com/ggml-org/llama.cpp/commit/5c0d18881e0e9794c96b2602736b758bac9d9388. If an immediate upgrade is not possible, restrict the Android application to loading GGUF model files exclusively from trusted, integrity-verified sources (e.g., pre-validated SHA-256 checksums before passing to JNI) and disable or gate access to the bench_1model() benchmarking code path if it is not required in production builds. Adding an application-layer null check before calling bench_1model() is a viable short-term compensating control but does not address the root cause in the native layer. Note that the provided commit diff primarily shows build system and documentation changes; the precise null-check code fix may be in a file not fully captured in the supplied diff - verify the patched build independently before marking remediation complete.
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today