llama.cpp: malloc/delete mismatch in the Android JNI batch wrapper corrupts the heap

Impact

The allocation in new_1batch() uses malloc() while free_1batch() releases it with the C++ delete operator, corrupting allocator metadata. The reachable path is the LLaMA-Android JNI binding, not the server or CLI builds a datacenter typically runs, so fleet exposure is limited to hosts that build and load the Android binding. Where it is reachable, the result is a process crash and, depending on allocator state, possible code execution in the inference process. Operators running llama.cpp only via llama-server or the CLI are not affected by this code path.

Who can reach it

Local, requires user interaction per the vendor vector: an actor who can drive the JNI binding (load a crafted model or call the binding directly). No authentication to a network service is involved.

What to do

Upgrade llama.cpp to build b7446 or later, which carries commit 5c0d188. Rollout is a rebuild of the binary and a restart of any serving process; no node drain or reboot. If you do not ship the Android JNI binding, no action is needed.

References

Related entries

• llama.cpp llama-server: crafted sampler parameter triggers out-of-bounds read and unauthenticated crashCVE-2026-43628 · llama.cpp llama-server (DRY sampler, /v1/completions and /v1/chat/completions)High
• NVIDIA OpenShell Sandbox: path traversal bypasses L7 REST network policy, exposing blocked endpointsCVE-2026-65092 · NVIDIA OpenShell Sandbox for Linux (L7 REST network policy enforcement)High
• llama.cpp: integer overflow in new_1batch undersizes the batch allocationCVE-2026-70638 · llama.cpp LLaMA-Android JNI wrapper (new_1batch n_seq_max sizing)High
• Darknet: integer overflow in convolutional layer sizing yields a heap overflow from a crafted .cfgCVE-2026-72852 · hank-ai/darknet convolutional layer (.cfg model definition parsing)High
• vLLM: remote processor code executes even when trust_remote_code is falseCVE-2026-90553 · vLLM (LlavaOnevision2 processor loader)High
• skops (`Card.get_model`): Model card loading has no trusted-types checkCVE-2025-54886 · skops (`Card.get_model`)High