CVE-2026-70639: llama.cpp from b1886 (inclusive), through b7445 (inclusive), b1886 through b7445, 0.9.0 through 0.17.1

Affected technology

llama.cpp · from b1886 (inclusive), through b7445 (inclusive)
ggml

llama.cpp · b1886 through b7445, 0.9.0 through 0.17.1
ggml-org

Description’s affected range: through b7445

Component: Not specified by the source
Function: fails

Attack conditions (Vendor/CNA, CVSS 4.0): Local · No privileges required · Passive user interaction

What an attacker can do

Attackers can supply a malicious, corrupt, or truncated model file to trigger a null context condition, causing a SIGSEGV crash that terminates the Android application process and results in denial of service. Vendor/CNA’s CVSS 4.0 assessment (base score 6.8/10) rates confidentiality and integrity impact as none; availability impact as high.