Description

llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new_1batch() function multiplies sizeof(llama_seq_id) by an attacker-controlled n_seq_max parameter without overflow validation, causing heap buffer allocation to wrap and allocate insufficient memory. Attackers can exploit this by providing a crafted n_seq_max value through a malicious model file or JNI call to trigger heap corruption and achieve denial of service or arbitrary code execution on Android applications using the LLaMA-Android binding.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-06T22:18:28.633Z",
  "pubdate": "2026-08-06T22:18:28.633Z",
  "executiveSummary": "An integer overflow vulnerability exists in the LLaMA-Android JNI wrapper within the builds b1886 through b7445.\nThe flaw resides in the new_1batch() function, which improperly handles arithmetic operations involving the attacker-controlled n_seq_max parameter and sizeof(llama_seq_id).\nThis arithmetic failure leads to insufficient heap buffer allocation, ultimately resulting in heap corruption.\nAttackers can exploit this vulnerability by supplying a crafted n_seq_max value via a malicious model file or a direct Java Native Interface (JNI) call.\nSuccessful exploitation allows malicious actors to cause a denial of service or achieve arbitrary code execution within the context of Android applications utilizing the affected LLaMA-Android binding.\nThe high severity of this issue stems from the potential for arbitrary code execution on vulnerable mobile client applications without requiring prior authentication.",
  "technicalDetails": "The root cause of the vulnerability is an unvalidated integer multiplication within the new_1batch() function of the LLaMA-Android JNI wrapper.\nSpecifically, the code multiplies sizeof(llama_seq_id) by the attacker-controlled n_seq_max parameter without implementing proper overflow checks or bounds validation.\nWhen an attacker supplies a maliciously crafted large value for n_seq_max, the multiplication operation wraps around due to integer overflow, resulting in a drastically reduced allocation size calculation compared to the actual required memory.\nConsequently, the subsequent heap buffer allocation reserves insufficient memory for the intended operational buffers.\nDuring runtime operations where data is written to the undersized buffer, a heap-based buffer overflow (heap corruption) occurs.\nThe attack flow begins when an Android application processes a malicious model file or receives a crafted JNI call containing the manipulated n_seq_max parameter.\nThe LLaMA-Android binding processes this input within the vulnerable new_1batch() function, triggering the integer overflow and subsequent heap memory miscalculation.\nThe affected component is the LLaMA-Android JNI wrapper, specifically within builds b1886 through b7445.\nThis vulnerability requires no authentication or special privileges from the attacker, and the attack vector relies on local application processing of untrusted model files or input vectors exposed through JNI boundaries.\nPost-exploitation impact includes application crashes leading to denial of service, or memory corruption manipulation that may enable arbitrary code execution on the target Android device."
}