CVE-2026-116096 | ggml-org llama.cpp up to b9060 Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots mmproj out-of-bounds write

A vulnerability has been found in ggml-org llama.cpp and classified as problematic. Affected by this issue is the function list_pockettts_state_slots of the file tools/mtmd/models/pockettts-gen.cpp of the component Pocket-TTS. This manipulation of the argument mmproj causes out-of-bounds write.

This vulnerability appears as CVE-2026-116096. The attack requires local access. In addition, an exploit is available.

The affected component should be upgraded.

The reported heap out‑of‑bounds write (gen‑audio / pocket‑tts state_out path) is no longer a silent exploitable heap write on current master and the latest release b11871 – a malicious mmproj that previously triggered it now trips a release‑active GGML_ASSERT and aborts. But the submitter’s recommended by‑construction fix (PR #29360 “prevent OOB accesses from malformed mmproj files”) is still open. So the root cause is detected‑and‑aborted, not prevented‑by‑design.VulDB Recent EntriesRead More