CVE-2026-43622

highCVSS 7.8covered by 1 sourcefirst seen 2026-08-06

llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1batch() allocates memory using malloc() while free_1batch() deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management mismatch to cause denial of service through process crashes or potentially achieve arbitrary code execution depending on allocator state.

⚡ Watch CVE-2026-43622

Get an email if CVE-2026-43622 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

highCVE-2026-43622: llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android …nvd · 2026-08-06

External references

NVD record for CVE-2026-43622

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-43622 status](https://www.csirts.com/badge/CVE-2026-43622)](https://www.csirts.com/cve/CVE-2026-43622)