CyberRota Analysis
AI-GeneratedThe LLaMA-Android JNI wrapper in specific builds of llama.cpp contains a double free vulnerability that arises from improper memory management, where memory allocated with malloc() is deallocated using the C++ delete operator. This flaw can lead to heap metadata corruption, resulting in denial of service through process crashes, and may allow attackers to execute arbitrary code depending on the state of the memory allocator. Android developers and organizations utilizing affected versions should prioritize patching this vulnerability to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1batch() allocates memory using malloc() while free_1batch() deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management mismatch to cause denial of service through process crashes or potentially achieve arbitrary code execution depending on allocator state.