CVE-2026-70639: Ggml Llama.cpp

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench_1model() function fails to validate the model context pointer before dereferencing it. Attackers can supply a malicious, corrupt, or truncated model file to trigger a null context condition, causing a SIGSEGV crash that terminates the Android application process and results in denial of service.

Affected products

• Ggml Llama.cpp: from b1886, up to and including b7445

Published 2026-08-06. Last modified 2026-09-21.