CVE-2026-70639

Publié : 6 août 2026

Modifié : 6 août 2026

Score CVSS

5.5

MEDIUM

Description détaillée

llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench_1model() function fails to validate the model context pointer before dereferencing it. Attackers can supply a malicious, corrupt, or truncated model file to trigger a null context condition, causing a SIGSEGV crash that terminates the Android application process and results in denial of service.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Références et Patchs

https://github.com/Vladimir-tokarev-cyera/llama-cpp-security-patches https://github.com/ggml-org/llama.cpp/commit/5c0d18881e0e9794c96b2602736b758bac9d9388 https://github.com/ggml-org/llama.cpp/releases/tag/b7446

Dernières Vulnérabilités

CVE-2026-70332

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

VOIR DÉTAILS

CVE-2026-68823

Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network.

VOIR DÉTAILS

CVE-2026-65668

Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network.

VOIR DÉTAILS