Description

llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1batch() allocates memory using malloc() while free_1batch() deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management mismatch to cause denial of service through process crashes or potentially achieve arbitrary code execution depending on allocator state.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-06T16:16:42.883Z",
  "pubdate": "2026-08-06T16:16:42.883Z",
  "executiveSummary": "A memory management mismatch vulnerability exists in the LLaMA-Android Java Native Interface (JNI) wrapper within llama.cpp builds b1886 through b7445. The flaw stems from an improper implementation of memory allocation and deallocation routines between the native functions new_1batch() and free_1batch(). Specifically, memory allocated via the C standard library function malloc() is subsequently released using the C++ delete operator, introducing a double free or heap corruption condition. This discrepancy leads to critical heap metadata corruption during execution. The primary impact of this vulnerability includes application denial of service resulting from unexpected process termination, as well as the potential for arbitrary code execution depending on the prevailing state of the heap allocator. Attackers capable of interacting with the vulnerable LLaMA-Android interface can trigger this memory management flaw to destabilize the host application. Exploitation relies on invoking the mismatched allocation and deallocation sequences within the targeted Android environment. The risk implication is severe, as memory corruption in native libraries frequently compromises overall system integrity and application security boundaries.",
  "technicalDetails": "The vulnerability resides within the LLaMA-Android JNI wrapper component of llama.cpp across affected versions b1886 through b7445. The root cause is a severe memory management mismatch occurring between two interacting native functions: new_1batch() and free_1batch(). During the execution of the application, the new_1batch() function allocates memory buffers intended for batch processing by invoking the C-style memory allocation routine malloc(). However, when the lifecycle of the batch object concludes, the corresponding deallocation routine, free_1batch(), improperly releases the referenced memory by employing the C++ scalar delete operator instead of matching the allocation primitive with the appropriate free() call.\nThis fundamental mismatch between malloc() and delete violates core memory management safety guarantees in mixed C/C++ environments, resulting in heap metadata corruption and undefined behavior. The attack flow begins when an external or internal actor interacts with the JNI wrapper to instantiate and subsequently destroy batch objects managed by the affected functions. By triggering the sequence of new_1batch() followed by free_1batch(), the runtime executes the invalid deallocation path, corrupting internal heap chunk headers and control structures maintained by the memory allocator.\nThe exploitation method relies on manipulating the corrupted heap state. When subsequent memory allocation or deallocation operations occur, the allocator encounters compromised metadata, which can immediately trigger a segmentation fault or unhandled exception, resulting in a denial of service via process crash. In more advanced scenarios, an attacker who can precisely control heap layouts and allocation timings may leverage the heap corruption primitives to manipulate adjacent memory objects, potentially achieving arbitrary code execution within the security context of the Android application. The vulnerable component is strictly the LLaMA-Android JNI wrapper layer. Authentication and privilege requirements depend entirely on the host application's local execution context and API exposure, while network exposure is indirect unless the application exposes the vulnerable batch processing functionality via network services. Post-exploitation impact ranges from local application crashes to full control over the application process space if arbitrary code execution is successfully realized."
}