Executive brief
llama.cpp is a popular C++ inference library for large language models that can be embedded in applications to run AI models locally. A memory management bug in the Android JNI (Java Native Interface) wrapper causes heap corruption when memory allocated with malloc() is incorrectly freed using the C++ delete operator, allowing attackers to crash the application or potentially execute arbitrary code.
Technical details
The vulnerability is a classic double-free / heap corruption issue in the LLaMA-Android JNI bindings where the new_1batch() function allocates memory using C's malloc() but the corresponding free_1batch() function deallocates it using C++'s delete operator. This mismatch causes heap metadata corruption. The vulnerability affects builds b1886 through b7445. Exploitation requires the ability to trigger batch creation and cleanup operations through the JNI interface, which is available to any application using the vulnerable llama.cpp Android bindings. An attacker can achieve denial of service via process crash or, depending on heap allocator state and exploitation techniques, potentially arbitrary code execution. The vulnerability was reported to the maintainers in July 2025 but unresolved as of June 2026; a patch is available via community security repositories.
Affected products
- ggml-org llama.cpp builds b1886 through b7445
Timeline
- 2025-07: disclosed: First vulnerability submitted via GitHub Security Advisory
- 2026-05: advisory: VulnCheck allocated CVE-2026-43622
- 2026-08-06: advisory: Published on NVD