CVE-2026-70638

Name of the Vulnerable Software and Affected Versions llama.cpp versions b1886 through b7445

Description An integer overflow exists in the LLaMA-Android JNI wrapper. The new 1batch() function multiplies the size of llama seq id by the n seq max parameter without validating for overflows. This can lead to a heap buffer allocation wrap, resulting in insufficient memory allocation. An attacker can provide a crafted n seq max value via a malicious model file or JNI call to cause heap corruption, potentially leading to denial of service or arbitrary code execution on Android applications utilizing the LLaMA-Android binding.

Recommendations Update llama.cpp to a version later than b7445.