CVE-2026-116096: ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write
A weakness has been identified in ggml-org llama.cpp. Affected by this issue is the function listpocketttsstateslots of the file tools/mtmd/models/pockettts-gen.cpp of the component Pocket-TTS. This manipulation of the argument mmproj causes out-of-bounds write. The attack requires local access. The exploit has been made available to the public and could be used for attacks. Upgrading to version b11796 can resolve this issue. Patch name: 0a1ef309cdbb9f2024f58a38fb4c42352c5db569. The affected component should be upgraded. The reported heap out‑of‑bounds write (gen‑audio / pocket‑tts stateout path) is no longer a silent exploitable heap write on current master and the latest release b11871 - a malicious mmproj that previously triggered it now trips a release‑active GGMLASSERT and aborts. But the submitter's recommended by‑construction fix (PR #29360 "prevent OOB accesses from malformed mmproj files") is still open. So the root cause is detected‑and‑aborted, not prevented‑by‑design.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ggml-org/llama.cppto a version that resolves this vulnerability.Fixed in b11796
Event History
Frequently Asked Questions
Who is exposed to this issue?
Exposure requires local access and use of the Pocket-TTS component, specifically a workflow that processes an attacker-controlled or malformed mmproj file. The issue is in tools/mtmd/models/pockettts-gen.cpp.
What must an attacker provide to trigger the vulnerability?
An attacker needs to manipulate the mmproj argument with a malicious mmproj file. Public exploit availability has been reported, but exploitation still requires local access and the vulnerable Pocket-TTS processing path.
Is the issue still silently exploitable on current master or release b11871?
No. A malicious mmproj that previously triggered the heap out-of-bounds write now reaches a release-active GGML_ASSERT and aborts rather than silently continuing with the heap write. The root cause is detected and aborted, not prevented by design.
What remediation is available?
Upgrade the affected component to version b11796 or later. The identified patch is 0a1ef309cdbb9f2024f58a38fb4c42352c5db569; current master and release b11871 also abort on the known malformed-mmproj trigger.
What can be done if an upgrade cannot happen immediately?
Do not process untrusted or malformed mmproj files through the Pocket-TTS gen-audio/state_out path, and restrict local access to systems that run it. This reduces the opportunity for an attacker to supply the manipulated mmproj required for the issue.