llama.cpp: Llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the…
llama.cpp
More for llama.cpp RSS feed for llama.cpp
- Severity
- Medium, CVSS 5.5
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- Record
- CVE-2026-70639
- Affects
- llama.cpp
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 6, 2026
- Source last modified
- October 24, 2026
Description
llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench_1model() function fails to validate the model context pointer before dereferencing it. Attackers can supply a malicious, corrupt, or truncated model file to trigger a null context condition, causing a SIGSEGV crash that terminates the Android application process and results in denial of service.
Description quoted from the NVD record.