CVE-2026-43622

HIGH 7.8

llama.cpp b1886–b7445 Double Free via llama-android.cpp

CVSS Score

7.8

EPSS Score

0.0%

EPSS Percentile

0th

llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1batch() allocates memory using malloc() while free_1batch() deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management mismatch to cause denial of service through process crashes or potentially achieve arbitrary code execution depending on allocator state.

CWE	CWE-762 CWE-415
Vendor	ggml-org
Product	llama.cpp
Published	Aug 6, 2026

Stay Ahead of the Next One

Get instant alerts for ggml-org llama.cpp

Be the first to know when new high vulnerabilities affecting ggml-org llama.cpp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

ggml-org / llama.cpp

b1886 ≤ b7445 0.9.0 ≤ 0.17.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/ggml-org/llama.cpp/releases/tag/b7446 github.com: https://github.com/ggml-org/llama.cpp/commit/5c0d18881e0e9794c96b2602736b758bac9d9388 github.com: https://github.com/Vladimir-tokarev-cyera/llama-cpp-security-patches

Credits

Vladimir Tokarev (@G1ND1L4) - Vulnerability Research Tech Lead, Cyera Ofek Itach (@ofekitach) - Security Research Team Lead, Cyera