Description

llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench_1model() function fails to validate the model context pointer before dereferencing it. Attackers can supply a malicious, corrupt, or truncated model file to trigger a null context condition, causing a SIGSEGV crash that terminates the Android application process and results in denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-06T22:18:28.783Z",
  "pubdate": "2026-08-06T22:18:28.783Z",
  "executiveSummary": "A null pointer dereference vulnerability exists in the LLaMA-Android Java Native Interface (JNI) wrapper within llama.cpp builds b1886 through b7445. The flaw is triggered when the application processes a malicious, corrupt, or truncated model file, causing the bench_1model() function to fail validation of the model context pointer prior to memory access.\nThe primary impact of this vulnerability is a Denial of Service (DoS) affecting the Android application process. When the unvalidated pointer is dereferenced, the operating system generates a SIGSEGV signal, immediately terminating the host application and disrupting service availability for mobile users.\nThe affected systems include Android applications integrating vulnerable builds of llama.cpp. Exploitation requires an attacker to possess the capability to supply or substitute a malicious, corrupt, or truncated model file read by the application. No specific authentication, network exposure, or elevated privileges are required beyond the ability to input the malformed file into the parsing pipeline.",
  "technicalDetails": "The vulnerability resides in the LLaMA-Android JNI wrapper component of llama.cpp, specifically within the bench_1model() function. The affected software versions span build b1886 through build b7445. The root cause of the vulnerability is the absence of adequate input validation and pointer checking regarding the model context pointer generated during model initialization.\nUnder normal execution, the model loading routine initializes a model context pointer used for subsequent inference and benchmarking operations. However, when supplied with a malicious, corrupt, or truncated model file, the initialization routine fails to construct a valid context but does not safely handle the error state or return a null pointer to the caller. Subsequently, the bench_1model() function attempts to dereference this unvalidated pointer directly without verifying its non-null status.\nThe attack flow proceeds as follows: First, the attacker provides a specially crafted, corrupt, or truncated model file to the Android application. Second, the application passes this file into the native LLaMA-Android JNI layer for processing and benchmarking via bench_1model(). Third, the parsing logic encounters the malformed structure, resulting in a failure to instantiate the model context, yielding a null reference. Fourth, the bench_1model() function attempts to read or write to the memory address represented by the null pointer. Finally, the hardware memory management unit detects the invalid access, triggering a SIGSEGV (Segmentation Fault) crash that forcefully terminates the Android application process, achieving a complete Denial of Service.\nThe vulnerability manifests entirely within the local execution context of the mobile application handling the file. It requires no network exposure, remote protocol interaction, user authentication, or elevated privilege levels, relying purely on local file supply or malicious file ingestion vectors."
}