Out-of-bounds write in llama.cpp Pocket-TTS state slot listing
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
llama.cpp versions from 0.4.0 before b11796 are affected by an out-of-bounds write in the list_pockettts_state_slots function of the Pocket-TTS component (CWE-787). A malicious mmproj argument causes the function to write past the bounds of a memory buffer. An attacker with local access can trigger it, and a public exploit is referenced. Current builds abort on a malicious mmproj file instead of writing, but the root cause is detected and aborted rather than prevented by design.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
A weakness has been identified in ggml-org llama.cpp. Affected by this issue is the function list_pockettts_state_slots of the file tools/mtmd/models/pockettts-gen.cpp of the component Pocket-TTS. This manipulation of the argument mmproj causes out-of-bounds write. The attack requires local access. The exploit has been made available to the public and could be used for attacks. Upgrading to version b11796 can resolve this issue. Patch name: 0a1ef309cdbb9f2024f58a38fb4c42352c5db569. The affected component should be upgraded. The reported heap out‑of‑bounds write (gen‑audio / pocket‑tts state_out path) is no longer a silent exploitable heap write on current master and the latest release b11871 - a malicious mmproj that previously triggered it now trips a release‑active GGML_ASSERT and aborts. But the submitter's recommended by‑construction fix (PR #29360 "prevent OOB accesses from malformed mmproj files") is still open. So the root cause is detected‑and‑aborted, not prevented‑by‑design.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ggml-org | llama.cpp | 0.4.0; 0.17.1; 55abc39; 55d4206c8; b5693; b7445; b7824; b8492; b8585; b9058; b9060 | b11796 | Patch available | CNA |
- llama.cpp Vendorggml-org Affected 0.4.0; 0.17.1; 55abc39; 55d4206c8; b5693; b7445; b7824; b8492; b8585; b9058; b9060 Fixed in b11796 Patch available CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ggml-org:llama.cpp:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:ggml-org:llama.cpp:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
Upgrade llama.cpp to version b11796 or later, such as the latest release b11871.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA llama.cpp (ggml-org) Fixed in b11796
Timeline
- 2026-10-25 Threatist record created from CVE-2026-116096
- 2026-10-26 CISA SSVC decision points changed
- 2026-10-26 Priority changed: LOW → MEDIUM
- 2026-10-27 Alias added: GHSA-w879-pch3-42x5
References
Exploit 2
Patch 3
More ggml-org vulnerabilities
- TI-2026-26459 llama.cpp: Unauthenticated RCE via GRAPH_COMPUTE buffer=0 bypass in llama.cpp RPC backend CVSS 3.1CRITICAL 9.8
- TI-2024-28446 llama.cpp allows Arbitrary Address Read in rpc_server::get_tensor CVSS 3.1CRITICAL 9.8
- TI-2026-17570 llama.cpp has Out-of-bounds Write in llama-server CVSS 3.1CRITICAL 9.8
- TI-2024-28447 llama.cpp allows write-what-where in rpc_server::set_tensor CVSS 3.1CRITICAL 10.0
- TI-2024-15627 Integer overflow in ggml-org llama.cpp CVSS 3.1CRITICAL 9.8
- TI-2024-14482 Heap-based buffer overflow in ggml-org llama.cpp CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-116096 · CVE Program
- CVE-2026-116096 · NVD
- FIRST EPSS
- GHSA-w879-pch3-42x5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences