CVE-2026-116096

ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write

View on CVE.org
Published Oct 25, 2026 CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Description
A weakness has been identified in ggml-org llama.cpp. Affected by this issue is the function list_pockettts_state_slots of the file tools/mtmd/models/pockettts-gen.cpp of the component Pocket-TTS. This manipulation of the argument mmproj causes out-of-bounds write. The attack requires local access. The exploit has been made available to the public and could be used for attacks. Upgrading to version b11796 can resolve this issue. Patch name: 0a1ef309cdbb9f2024f58a38fb4c42352c5db569. The affected component should be upgraded. The reported heap out‑of‑bounds write (gen‑audio / pocket‑tts state_out path) is no longer a silent exploitable heap write on current master and the latest release b11871 - a malicious mmproj that previously triggered it now trips a release‑active GGML_ASSERT and aborts. But the submitter's recommended by‑construction fix (PR #29360 "prevent OOB accesses from malformed mmproj files") is still open. So the root cause is detected‑and‑aborted, not prevented‑by‑design.

Analysis

AI-generated

Technical impact

The flaw exists in the list_pockettts_state_slots function in Pocket‑TTS, where processing the mmproj argument can lead to a buffer overflow on the heap. When triggered by a malicious or malformed mmproj file, the write occurs outside the bounds of allocated memory, potentially corrupting adjacent data. While the latest master and release b11871 now abort on detection, the earlier affected versions perform the write silently, which can be leveraged by a local adversary to compromise the target system.

Affected Systems

The vulnerability affects the ggml‑org llama.cpp project, specifically the Pocket‑TTS component in the file tools/mtmd/models/pockettts-gen.cpp. Versions prior to b11871, including b11796 and earlier releases, are vulnerable. Upgrading to at least v b11796, and preferably to the current v b11871, resolves the issue by aborting on malformed input.

Risk and Exploitability

With a CVSS score of 4.8 and no EPSS data, the severity is moderate. The exploit requires local access to supply a crafted mmproj file, which limits its usefulness to insiders or attackers who have gained local foothold. The flaw is not listed in the CISA KEV catalog, and current releases mitigate the risk by triggering an assertion and aborting. However, systems running older releases remain susceptible to heap corruption attacks.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade llama.cpp to version b11796 or later, ideally to the current b11871 release that aborts on malformed mmproj files.
  • Validate and sanitize mmproj inputs before they are processed by Pocket‑TTS, rejecting malformed or oversized files as a precaution.
  • Enable compiler hardening options such as stack canaries, address space layout randomization, and memory safety checks to reduce the impact of any remaining buffer overflows.

Generated by OpenCVE AI on October 26, 2026 at 00:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Ggml
Ggml llama.cpp
Vendors & Products Ggml
Ggml llama.cpp
Type Values Removed Values Added
Description A weakness has been identified in ggml-org llama.cpp. Affected by this issue is the function list_pockettts_state_slots of the file tools/mtmd/models/pockettts-gen.cpp of the component Pocket-TTS. This manipulation of the argument mmproj causes out-of-bounds write. The attack requires local access. The exploit has been made available to the public and could be used for attacks. Upgrading to version b11796 can resolve this issue. Patch name: 0a1ef309cdbb9f2024f58a38fb4c42352c5db569. The affected component should be upgraded. The reported heap out‑of‑bounds write (gen‑audio / pocket‑tts state_out path) is no longer a silent exploitable heap write on current master and the latest release b11871 - a malicious mmproj that previously triggered it now trips a release‑active GGML_ASSERT and aborts. But the submitter's recommended by‑construction fix (PR #29360 "prevent OOB accesses from malformed mmproj files") is still open. So the root cause is detected‑and‑aborted, not prevented‑by‑design.
Title ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write
First Time appeared Ggml-org
Ggml-org llama.cpp
Weaknesses CWE-119
CWE-787
CPEs cpe:2.3:a:ggml-org:llama.cpp:*:*:*:*:*:*:*:*
Vendors & Products Ggml-org
Ggml-org llama.cpp
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-787

    Out-of-bounds Write

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 26, 2026, 4:38 PM
Reserved
Oct 25, 2026, 6:55 AM

View source JSON

Updated
Oct 26, 2026, 3:59 PM

JSON

Status
Deferred
Published
Oct 25, 2026, 11:17 PM
Modified
Oct 26, 2026, 5:17 PM

View source JSON

No data.

Updated
Oct 26, 2026, 12:45 AM

JSON