CVE-2026-43622
llama.cpp b1886–b7445 Double Free via llama-android.cpp
CVSS Score
7.8
EPSS Score
0.0%
EPSS Percentile
0th
llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1batch() allocates memory using malloc() while free_1batch() deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management mismatch to cause denial of service through process crashes or potentially achieve arbitrary code execution depending on allocator state.
| CWE | CWE-762 CWE-415 |
| Vendor | ggml-org |
| Product | llama.cpp |
| Published | Aug 6, 2026 |
| Last Updated | Aug 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for ggml-org llama.cpp
Be the first to know when new high vulnerabilities affecting ggml-org llama.cpp are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
ggml-org / llama.cpp
b1886 ≤ b7445 0.9.0 ≤ 0.17.1
References
github.com: https://github.com/ggml-org/llama.cpp/releases/tag/b7446 github.com: https://github.com/ggml-org/llama.cpp/commit/5c0d18881e0e9794c96b2602736b758bac9d9388 github.com: https://github.com/Vladimir-tokarev-cyera/llama-cpp-security-patches vulncheck.com: https://www.vulncheck.com/advisories/llama-cpp-b1886-b7445-double-free-via-llama-android-cpp
Credits
Vladimir Tokarev (@G1ND1L4) - Vulnerability Research Tech Lead, Cyera Ofek Itach (@ofekitach) - Security Research Team Lead, Cyera