CVE-2026-43622: llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1batch() allocates memory using malloc() while free_1batch() dea

highCVSS 7.8CVE-2026-43622

llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1batch() allocates memory using malloc() while free_1batch() deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management mismatch to cause denial of service through process crashes or potentially achieve arbitrary code execution depending on allocator state.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: high — CVSS 7.8
Published: 2026-08-06
Last updated: 2026-08-06
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-43622

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-43622	coverage & exploitation status	NVD · CVE.org

Recent advisories for llama.cpp builds b1886

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2026-70640: llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in …nvd · 2026-08-06
mediumCVE-2026-70639: llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the L…nvd · 2026-08-06
highCVE-2026-70638: llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-An…nvd · 2026-08-06

CVE-2026-43622: llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1batch() allocates memory using malloc() while free_1batch() dea

Details

Referenced CVEs

Recent advisories for llama.cpp builds b1886

More from NVD Recent CVEs