Integer Overflow Vulnerability in LLaMA-Android JNI Wrapper from GGML

CVE-2026-70638

What is CVE-2026-70638?

The LLaMA-Android JNI wrapper in the llama.cpp builds from b1886 to b7445 has an integer overflow vulnerability. This flaw occurs in the new_1batch() function, where the multiplication of sizeof(llama_seq_id) with the unvalidated attacker-controlled parameter n_seq_max can lead to insufficient heap memory allocation. An attacker can exploit this vulnerability by injecting a crafted n_seq_max value through a malicious model file or JNI call, resulting in heap corruption. This exploitation may enable a denial of service or even arbitrary code execution on Android applications leveraging the LLaMA-Android library.

References