ggml-org llama.cpp up to b9060 Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots mmproj out-of-bounds write

Summaryinfo

A vulnerability was found in ggml-org llama.cpp and classified as problematic. This affects the function list_pockettts_state_slots of the file tools/mtmd/models/pockettts-gen.cpp of the component Pocket-TTS. Such manipulation of the argument mmproj leads to out-of-bounds write. This vulnerability is traded as CVE-2026-116096. An attack has to be approached locally. Furthermore, there is an exploit available. It is suggested to upgrade the affected component. The reported heap out‑of‑bounds write (gen‑audio / pocket‑tts state_out path) is no longer a silent exploitable heap write on current master and the latest release b11871 - a malicious mmproj that previously triggered it now trips a release‑active GGML_ASSERT and aborts. But the submitter's recommended by‑construction fix (PR #29360 "prevent OOB accesses from malformed mmproj files") is still open. So the root cause is detected‑and‑aborted, not prevented‑by‑design.

Detailsinfo

A vulnerability was found in ggml-org llama.cpp and classified as problematic. Affected by this issue is the function list_pockettts_state_slots of the file tools/mtmd/models/pockettts-gen.cpp of the component Pocket-TTS. The manipulation of the argument mmproj with an unknown input leads to a out-of-bounds write vulnerability. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-116096. The exploitation is known to be easy. The attack needs to be approached locally. Technical details as well as a public exploit are known.

The exploit is available at github.com. It is declared as proof-of-concept. The reported heap out‑of‑bounds write (gen‑audio / pocket‑tts state_out path) is no longer a silent exploitable heap write on current master and the latest release b11871 - a malicious mmproj that previously triggered it now trips a release‑active GGML_ASSERT and aborts. But the submitter's recommended by‑construction fix (PR #29360 "prevent OOB accesses from malformed mmproj files") is still open. So the root cause is detected‑and‑aborted, not prevented‑by‑design.

Upgrading to version b11796 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 0a1ef309cdbb9f2024f58a38fb4c42352c5db569 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• ggml-org

Name

• llama.cpp

Version

• 0.4.0
• 0.17.1
• 55abc39
• 55d4206c8
• b5693
• b7445
• b7824
• b8492
• b8585
• b9058
• b9060

License

• open-source

Website

• Product: https://github.com/ggml-org/llama.cpp/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #1000891: ggml-org xxxxxxxxxx llama.cpp up to main commit 8212c7802455255460ab8e18fc34754560031b34 (latest release b11160, 2026-09-24) Out-of-Bounds Write (CWE-787) (by Dem00000)

Once again VulDB remains the best source for vulnerability data.

Discussion