CVE-2026-43622
Received Received - Intake

Double Free in llama.cpp LLaMA-Android JNI Wrapper

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: VulnCheck

Description
llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1batch() allocates memory using malloc() while free_1batch() deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management mismatch to cause denial of service through process crashes or potentially achieve arbitrary code execution depending on allocator state.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-43622
EUVD
EUVD-2026-54096

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ggml-org llama.cpp *
cyera_research llama.cpp *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-762 The product attempts to return a memory resource to the system, but it calls a release function that is not compatible with the function that was originally used to allocate that resource.
CWE-415 The product calls free() twice on the same memory address.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a double free issue in llama.cpp versions b1886 through b7445. The LLaMA-Android JNI wrapper incorrectly uses malloc() for memory allocation in new_1batch() but uses the C++ delete operator for deallocation in free_1batch(). This mismatch corrupts heap metadata, potentially causing denial of service through crashes or enabling arbitrary code execution depending on the allocator state.

Detection Guidance

This vulnerability is specific to the LLaMA-Android JNI wrapper in llama.cpp versions b1886 through b7445. To detect it, check the version of llama.cpp or LLaMA-Android in use on your system. If you are running an affected version, look for crashes or memory corruption errors in Android applications using the JNI wrapper.

Impact Analysis

If you use affected versions of llama.cpp on Android, an attacker could trigger this flaw to crash the application or execute malicious code. This could lead to unauthorized access, data theft, or disruption of service on your device.

Mitigation Strategies

Upgrade to a patched version of llama.cpp or LLaMA-Android. The vulnerability is addressed in versions after b7445. If upgrading is not possible, disable or remove the LLaMA-Android JNI wrapper from your system to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-43622. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart