A weakness has been identified in ggml-org llama.cpp. Affected by this issue is the function list_pockettts_state_slots of the file tools/mtmd/models/pockettts-gen.cpp of the component Pocket-TTS. This manipulation of the argument mmproj causes out-of-bounds write. The attack requires local access. The exploit has been made available to the public and could be used for attacks. Upgrading to version b11796 can resolve this issue. Patch name: 0a1ef309cdbb9f2024f58a38fb4c42352c5db569. The affected component should be upgraded. The reported heap out‑of‑bounds write (gen‑audio / pocket‑tts state_out path) is no longer a silent exploitable heap write on current master and the latest release b11871 - a malicious mmproj that previously triggered it now trips a release‑active GGML_ASSERT and aborts. But the submitter's recommended by‑construction fix (PR #29360 "prevent OOB accesses from malformed mmproj files") is still open. So the root cause is detected‑and‑aborted, not prevented‑by‑design.

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Local

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
ggml-org llama.cpp affected
Version Status Constraints
0.4.0 affected —
0.17.1 affected —
55abc39 affected —
55d4206c8 affected —
b5693 affected —
b7445 affected —
b7824 affected —
b8492 affected —
b8585 affected —
b9058 affected —
b9060 affected —
b11796 unaffected —

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Ggml Subscribe
Llama.cpp Subscribe
Ggml-org Subscribe
Llama.cpp Subscribe

Project Subscriptions

Vendors Products
Ggml Subscribe
Llama.cpp Subscribe
Ggml-org Subscribe
Llama.cpp Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/3em0/cve_repo/tree/main/2026/llama.cpp.pockettts_state_heap_oob_rce cve-icon cve-icon
https://github.com/3em0/cve_repo/tree/main/2026/llama.cpp.pockettts_state_heap_oob_rce/poc cve-icon cve-icon
https://github.com/ggml-org/llama.cpp/ cve-icon cve-icon
https://github.com/ggml-org/llama.cpp/commit/0a1ef309cdbb9f2024f58a38fb4c42352c5db569 cve-icon cve-icon
https://github.com/ggml-org/llama.cpp/pull/30902 cve-icon cve-icon
https://github.com/ggml-org/llama.cpp/releases/tag/b11796 cve-icon cve-icon
https://vuldb.com/cve/CVE-2026-116096 cve-icon cve-icon
https://vuldb.com/submit/1000891 cve-icon cve-icon
https://vuldb.com/vuln/426164 cve-icon cve-icon
https://vuldb.com/vuln/426164/cti cve-icon cve-icon
History

Mon, 26 Oct 2026 01:00:00 +0000

Type Values Removed Values Added
First Time appeared Ggml
Ggml llama.cpp
Vendors & Products Ggml
Ggml llama.cpp

Sun, 25 Oct 2026 23:15:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in ggml-org llama.cpp. Affected by this issue is the function list_pockettts_state_slots of the file tools/mtmd/models/pockettts-gen.cpp of the component Pocket-TTS. This manipulation of the argument mmproj causes out-of-bounds write. The attack requires local access. The exploit has been made available to the public and could be used for attacks. Upgrading to version b11796 can resolve this issue. Patch name: 0a1ef309cdbb9f2024f58a38fb4c42352c5db569. The affected component should be upgraded. The reported heap out‑of‑bounds write (gen‑audio / pocket‑tts state_out path) is no longer a silent exploitable heap write on current master and the latest release b11871 - a malicious mmproj that previously triggered it now trips a release‑active GGML_ASSERT and aborts. But the submitter's recommended by‑construction fix (PR #29360 "prevent OOB accesses from malformed mmproj files") is still open. So the root cause is detected‑and‑aborted, not prevented‑by‑design.
Title ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write
First Time appeared Ggml-org
Ggml-org llama.cpp
Weaknesses CWE-119
CWE-787
CPEs cpe:2.3:a:ggml-org:llama.cpp:*:*:*:*:*:*:*:*
Vendors & Products Ggml-org
Ggml-org llama.cpp
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-25T23:00:24.282Z

Reserved: 2026-10-25T06:55:29.373Z

Link: CVE-2026-116096

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-25T23:17:41.897

Modified: 2026-10-25T23:17:41.897

Link: CVE-2026-116096

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T00:45:06Z

Weaknesses