llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench_1model() function fails to validate the model context pointer before dereferencing it. Attackers can supply a malicious, corrupt, or truncated model file to trigger a null context condition, causing a SIGSEGV crash that terminates the Android application process and results in denial of service.
{
"cwe_ids": [
"CWE-476"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70639.json"
}[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"334411191698948442196723930483104454060",
"37366638444284429051614071922669106979",
"139232692773709095660313632590427735062",
"5259375327948776342389338159184170899"
]
},
"deprecated": false,
"source": "https://github.com/ggml-org/llama.cpp/commit/4b2a4778f81f222c12271ce3b1997990b3071faf",
"signature_type": "Line",
"target": {
"file": "common/arg.cpp"
},
"signature_version": "v1",
"id": "CVE-2026-70639-09f5f06e"
},
{
"digest": {
"length": 106923.0,
"function_hash": "337343721808502297225290834391498754494"
},
"deprecated": false,
"source": "https://github.com/ggml-org/llama.cpp/commit/4b2a4778f81f222c12271ce3b1997990b3071faf",
"signature_type": "Function",
"target": {
"file": "common/arg.cpp",
"function": "common_params_parser_init"
},
"signature_version": "v1",
"id": "CVE-2026-70639-8e669eb6"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70639.json"
"2026-08-09T08:05:13Z"