CVE-2026-70640 ggml-org CVE debrief

Who should care

Developers and administrators using llama.cpp builds b1886 through b7445, particularly those integrating LLaMA-Android JNI wrapper functionality, should be aware of this vulnerability and take steps to mitigate potential risks.

Technical summary

A race condition use-after-free vulnerability exists in llama.cpp builds b1886 through b7445. The vulnerability is located in the LLaMA-Android JNI wrapper, specifically affecting functions bench_1model() and free_1context(). Synchronization issues allow Thread A to operate on freed memory while Thread B concurrently frees the llama_context. Attackers can exploit this by performing heap spray with attacker-controlled data containing a fake vtable to hijack the vtable pointer at offset +0x30, causing llama_batch_allocr::clear() to dereference arbitrary memory and achieve remote code execution.

Defensive priority

High-priority defensive review required for llama.cpp builds b1886 through b7445 due to a race condition use-after-free vulnerability.

Recommended defensive actions

• Review and apply vendor-provided patches or updates for llama.cpp
• Implement additional monitoring and logging to detect potential exploitation attempts
• Conduct thorough inventory checks to identify affected systems and prioritize remediation
• Consider compensating controls, such as restricting access to vulnerable systems or implementing network segmentation
• Review system configurations and ensure proper synchronization mechanisms are in place
• Perform regular security audits to identify and address potential vulnerabilities
• Continuously monitor systems for suspicious activity and implement incident response plans

Evidence notes

Evidence from official sources indicates a race condition use-after-free vulnerability exists in llama.cpp builds b1886 through b7445. The vulnerability is located in the LLaMA-Android JNI wrapper, specifically affecting functions bench_1model() and free_1context(). Synchronization issues allow Thread A to operate on freed memory while Thread B concurrently frees the llama_context. Limited information is available on the exploitability and potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.