The vulnerability is an integer overflow in the LLaMA-Android JNI wrapper’s new_1batch() function, where the size for a heap buffer is computed by multiplying sizeof(llama_seq_id) by an attacker-controlled n_seq_max parameter without validation. This overflow allows the allocation to wrap and allocate less memory than required, leading to heap corruption. Attackers supplying a crafted n_seq_max value through a malicious model file or direct JNI call can trigger this corruption, enabling denial of service or, if executed in the context of the application, arbitrary code execution.

Products from ggml-org:llama.cpp, specifically builds b1886 through b7445, are impacted. Any Android application that loads llama.cpp via the LLaMA-Android binding and accepts externally supplied model files or n_seq_max values may be vulnerable.

The CVSS score of 8.5 indicates a high severity, but the EPSS score is not available, making precise exploitation likelihood undetermined. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this vulnerability if they can provide a controlled n_seq_max value, implying the attack vector is local to the application through malicious model files or an API call. Successful exploitation could lead to heap corruption, resulting in program crashes or code execution depending on the target environment.