Vulnerability · Published Oct 25, 2026 · Assigned by VulDB
CVE-2026-116096ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write
Medium 5.3
In plain English
A medium-severity out-of-bounds write in llama.cpp from ggml-org. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).
Official description
A weakness has been identified in ggml-org llama.cpp. Affected by this issue is the function list_pockettts_state_slots of the file tools/mtmd/models/pockettts-gen.cpp of the component Pocket-TTS. This manipulation of the argument mmproj causes out-of-bounds write. The attack requires local access. The exploit has been made available to the public and could be used for attacks. Upgrading to version b11796 can resolve this issue. Patch name: 0a1ef309cdbb9f2024f58a38fb4c42352c5db569. The affected component should be upgraded. The reported heap out‑of‑bounds write (gen‑audio / pocket‑tts state_out path) is no longer a silent exploitable heap write on current master and the latest release b11871 - a malicious mmproj that previously triggered it now trips a release‑active GGML_ASSERT and aborts. But the submitter's recommended by‑construction fix (PR #29360 "prevent OOB accesses from malformed mmproj files") is still open. So the root cause is detected‑and‑aborted, not prevented‑by‑design.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | llama.cpp | no fix listed | DEBIAN-CVE-2026-116096 |
| Ubuntu:26.04:LTS | llama.cpp | no fix listed | UBUNTU-CVE-2026-116096 |
| Ubuntu:26.10 | llama.cpp | no fix listed | UBUNTU-CVE-2026-116096 |
Affected products (as reported)
Weakness: CWE-787, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
References
- VDB-426164 | ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write vdb-entry, technical-description
- VDB-426164 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- CVE-2026-116096 | CVE Analysis and Report third-party-advisory
- Submit #1000891 | ggml-org xxxxxxxxxx llama.cpp up to main commit 8212c7802455255460ab8e18fc34754560031b34 (latest release b11160, 2026-09-24) Out-of-Bounds Write (CWE-787) third-party-advisory
- https://github.com/3em0/cve_repo/tree/main/2026/llama.cpp.pockettts_state_heap_oob_rce exploit
- https://github.com/ggml-org/llama.cpp/pull/30902 issue-tracking, patch
- https://github.com/3em0/cve_repo/tree/main/2026/llama.cpp.pockettts_state_heap_oob_rce/poc exploit
- https://github.com/ggml-org/llama.cpp/commit/0a1ef309cdbb9f2024f58a38fb4c42352c5db569 patch
- https://github.com/ggml-org/llama.cpp/releases/tag/b11796 patch
- https://github.com/ggml-org/llama.cpp/ product