The vulnerability arises from a double free in llama.cpp, where the new_1batch() function allocates memory with malloc() while free_1batch() deallocates that memory with the C++ delete operator, corrupting heap metadata. This mismatch can cause the process to crash, resulting in denial of service, or under certain allocator states may allow an attacker to execute arbitrary code. The flaw is a classic memory management error, reflected in the identified weaknesses CWE-415 and CWE-762.

Affected versions are those built between b1886 and b7445 of ggml-org:llama.cpp. No precise version list is supplied beyond this build range, so any deployment within these revisions is potentially vulnerable.

The CVSS score of 8.5 indicates high severity. The EPSS score is not available, making it difficult to gauge current exploitation likelihood, and the vulnerability is not listed in CISA’s KEV catalog. Attackers are likely to exploit the flaw from applications that invoke the llama-android JNI wrapper, possibly by supplying crafted batch inputs that trigger the memory deallocation mismatch. Because the flaw requires interacting with the JNI layer, the attack vector is inferred to be remote via the application interface, though the description does not explicitly state this.