The flaw exists in the list_pockettts_state_slots function in Pocket‑TTS, where processing the mmproj argument can lead to a buffer overflow on the heap. When triggered by a malicious or malformed mmproj file, the write occurs outside the bounds of allocated memory, potentially corrupting adjacent data. While the latest master and release b11871 now abort on detection, the earlier affected versions perform the write silently, which can be leveraged by a local adversary to compromise the target system.

The vulnerability affects the ggml‑org llama.cpp project, specifically the Pocket‑TTS component in the file tools/mtmd/models/pockettts-gen.cpp. Versions prior to b11871, including b11796 and earlier releases, are vulnerable. Upgrading to at least v b11796, and preferably to the current v b11871, resolves the issue by aborting on malformed input.

With a CVSS score of 4.8 and no EPSS data, the severity is moderate. The exploit requires local access to supply a crafted mmproj file, which limits its usefulness to insiders or attackers who have gained local foothold. The flaw is not listed in the CISA KEV catalog, and current releases mitigate the risk by triggering an assertion and aborting. However, systems running older releases remain susceptible to heap corruption attacks.