cmusphinx PocketSphinx up to 5.1.0 Trie Language-Model Loader ngram_model_trie.c sscanf heap-based overflow

Summaryinfo

A vulnerability was found in cmusphinx PocketSphinx up to 5.1.0 and classified as problematic. Affected by this vulnerability is the function sscanf of the file src/lm/ngram_model_trie.c of the component Trie Language-Model Loader. The manipulation results in heap-based overflow. This vulnerability is reported as CVE-2026-54559. The attack requires a local approach. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in cmusphinx PocketSphinx up to 5.1.0. Affected is the function sscanf of the file src/lm/ngram_model_trie.c of the component Trie Language-Model Loader. The manipulation with an unknown input leads to a heap-based overflow vulnerability. CWE is classifying the issue as CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

PocketSphinx is a small speech recognizer. Prior to 5.1.1, the trie language-model loaders in src/lm/ngram_model_trie.c do not adequately validate boundary conditions in ARPA, DMP, and binary format headers, and the acoustic-model loaders in src/mdef.c and src/util/bio.c use sscanf with unbounded string fields. Loading an invalid, corrupted, or malicious language or acoustic model can therefore cause stack or heap buffer overflows and memory corruption. An attacker who can write to a directory selected by POCKETSPHINX_PATH can replace or add a model file that PocketSphinx later loads; users of PocketSphinx 5prealpha have no backported patch and must migrate to the fixed release. This issue is fixed in version 5.1.1.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-54559 since 06/15/2026. The exploitability is told to be easy. Local access is required to approach this attack. Technical details are known, but there is no available exploit.

Upgrading to version 5.1.1 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• cmusphinx

Name

• PocketSphinx

Version

• 5.0
• 5.1.0

Website

• Product: https://github.com/cmusphinx/pocketsphinx/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion