llama.cpp: integer overflow in new_1batch undersizes the batch allocation

Impact

new_1batch() multiplies sizeof(llama_seq_id) by a caller-supplied n_seq_max with no overflow check, so the allocation wraps and the subsequent writes run past the buffer. A crafted model file or a direct JNI call supplies the value. This is a distinct mechanism from the malloc/delete mismatch fixed in the same commit, so it is listed separately. Exposure is confined to deployments that build the LLaMA-Android binding; llama-server and CLI deployments do not reach this path.

Who can reach it

Local, with user interaction: someone who can supply a model file to, or make calls into, the Android binding. No service authentication is involved.

What to do

Upgrade to llama.cpp build b7446 or later (commit 5c0d188) and restart the serving process. A rebuild and daemon restart is the whole cost; no node drain. Not applicable if the Android JNI binding is not built.

References

Related entries

• Darknet: integer overflow in convolutional layer sizing yields a heap overflow from a crafted .cfgCVE-2026-72852 · hank-ai/darknet convolutional layer (.cfg model definition parsing)High
• vLLM: remote processor code executes even when trust_remote_code is falseCVE-2026-90553 · vLLM (LlavaOnevision2 processor loader)High
• skops (`Card.get_model`): Model card loading has no trusted-types checkCVE-2025-54886 · skops (`Card.get_model`)High
• Jupyter Notebook and JupyterLab: stored XSS in the help command linker steals the session tokenCVE-2026-40171 · Jupyter Notebook / JupyterLab help-extension (command linker sanitizer)High
• mcp-shell: allowlist validates only the first token, so /bin/bash -c runs any commandCVE-2026-55581 · mcp-shell (security.go command allowlist, /bin/bash -c handling)High
• mcp-shell: allowed git binary runs arbitrary commands via a `!` alias, bypassing secure modeCVE-2026-55582 · mcp-shell (security.go shell-metacharacter checks, git alias handling)High