CVE-2026-70640: llama.cpp b1886–b7445 Race Condition Use-After-Free via llama-android.cpp
llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench1model() and free1context() lack synchronization, allowing Thread A to operate on freed memory while Thread B concurrently frees the llamacontext. Attackers can exploit this by performing heap spray with attacker-controlled data containing a fake vtable to hijack the vtable pointer at offset +0x30, causing llamabatchallocr::clear() to dereference arbitrary memory and achieve remote code execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70640?
CVE-2026-70640 has a high severity rating of 7.
How do I fix CVE-2026-70640?
To fix CVE-2026-70640, update to the latest version of Llama.cpp that is free from this vulnerability.
What types of vulnerabilities does CVE-2026-70640 involve?
CVE-2026-70640 involves race conditions, use-after-free, and null pointer dereference vulnerabilities.
What impact does CVE-2026-70640 have on system security?
CVE-2026-70640 allows attackers to operate on freed memory, potentially leading to arbitrary code execution.
In which versions of Llama.cpp is CVE-2026-70640 present?
CVE-2026-70640 is present in Llama.cpp builds from version b1886 through b7445.