CVE-2026-70639: llama.cpp b1886–b7445 Null Pointer Dereference DoS via llama-android.cpp
llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench1model() function fails to validate the model context pointer before dereferencing it. Attackers can supply a malicious, corrupt, or truncated model file to trigger a null context condition, causing a SIGSEGV crash that terminates the Android application process and results in denial of service.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70639?
CVE-2026-70639 has a medium severity rating of 5.5.
How do I fix CVE-2026-70639?
To fix CVE-2026-70639, update to version b7446 or later of the llama.cpp software.
What impact does CVE-2026-70639 have on the application?
CVE-2026-70639 can lead to a denial of service (DoS) attack through a null pointer dereference.
What software is affected by CVE-2026-70639?
The vulnerability affects versions b1886 through b7445 of the llama.cpp software.
How can attackers exploit CVE-2026-70639?
Attackers can exploit CVE-2026-70639 by supplying a malicious, corrupt, or truncated model file.