Description

llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench_1model() and free_1context() lack synchronization, allowing Thread A to operate on freed memory while Thread B concurrently frees the llama_context. Attackers can exploit this by performing heap spray with attacker-controlled data containing a fake vtable to hijack the vtable pointer at offset +0x30, causing llama_batch_allocr::clear() to dereference arbitrary memory and achieve remote code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-08-06T22:18:28.927Z",
  "pubdate": "2026-08-06T22:18:28.927Z",
  "executiveSummary": "A race condition use-after-free vulnerability exists in the LLaMA-Android JNI wrapper across builds b1886 through b7445. The flaw arises from a lack of synchronization between bench_1model() and free_1context(), permitting concurrent execution where Thread A operates on memory while Thread B frees the underlying llama_context. Successful exploitation requires an attacker to trigger the race condition and execute a heap spray utilizing attacker-controlled data containing a fake virtual method table (vtable). This corruption targets the vtable pointer located at offset +0x30, ultimately leading to the dereferencing of arbitrary memory during llama_batch_allocr::clear() execution. The impact of this vulnerability is severe, potentially achieving remote code execution within the context of the affected mobile application. The risk profile is elevated due to the potential for arbitrary code execution on compromised Android endpoints hosting the vulnerable JNI implementation.",
  "technicalDetails": "The vulnerability is rooted in a synchronization defect within the LLaMA-Android Java Native Interface (JNI) wrapper layer. Specifically, the native functions bench_1model() and free_1context() fail to implement proper thread synchronization primitives such as mutexes or critical sections when interacting with shared memory resources. This architectural oversight introduces a race condition window.\nThe attack flow proceeds as follows: Thread A initiates operations via bench_1model() accessing a specific memory region managed by the application. Concurrently, Thread B invokes free_1context(), which deallocates the underlying llama_context object that Thread A is actively referencing. Because the operations lack coordination, Thread A attempts to read from or write to the now-freed memory location, creating a classic use-after-free (UAF) condition.\nTo weaponize this condition, an attacker must execute a heap spray technique populated with attacker-controlled data. This sprayed payload is designed to occupy the newly freed heap space formerly allocated to the llama_context. Within this controlled data structure, the attacker crafts a fake vtable and aligns it to overwrite the target object's vtable pointer located at offset +0x30.\nSubsequent execution flow relies on the application invoking member functions on the corrupted object, specifically triggering llama_batch_allocr::clear(). During this execution, the application attempts to resolve a virtual function call using the corrupted vtable pointer at offset +0x30. Instead of pointing to legitimate program logic, the hijacked pointer forces the program counter to dereference arbitrary memory specified by the attacker. This arbitrary memory dereference subverts control flow integrity and enables remote code execution under the security context of the JNI process.\nThe vulnerable component is the LLaMA-Android JNI wrapper affecting builds b1886 through b7445. Exploitation requires local code execution capabilities or malicious input handling capable of triggering the asynchronous JNI method calls concurrently, though network exposure depends entirely on how the underlying application exposes these JNI wrappers to external data sources."
}