CVE-2026-116096: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2026-116096 is a heap out-of-bounds write vulnerability in the list_pockettts_state_slots function within tools/mtmd/models/pockettts-gen.cpp of the Pocket-TTS component in ggml-org/llama.cpp. The vulnerability is triggered by manipulating the mmproj argument with a maliciously crafted mmproj file, causing improper memory writes. Affected versions include builds up to and including b9060 (e.g., b5693, b7445, b7824, b8492, b8585, b9058, b9060, 0.4.0, 0.17.1); version b11796 and later are unaffected. It was published on October 25, 2026, with a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 1.9 (Low) (Github Advisory).

The root cause is classified as CWE-787 (Out-of-bounds Write) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). When a malformed mmproj file is processed by the list_pockettts_state_slots function in the Pocket-TTS audio generation pipeline, insufficient validation of the mmproj argument allows writes beyond the intended heap buffer boundary. The attack requires local access and low privileges — an attacker must be able to supply a crafted mmproj file to the llama.cpp Pocket-TTS tooling. Notably, on versions b11796 and later (including b11871), the previously silent heap write now triggers a GGML_ASSERT and aborts the process, meaning the root cause is detected-and-aborted rather than prevented by design; PR #29360 ("prevent OOB accesses from malformed mmproj files") addressing the by-construction fix remains open (Github Advisory). A public PoC repository with exploit scripts is available at github.com/3em0/cve_repo (PoC Repo).

Successful exploitation by a local attacker with low privileges can result in heap memory corruption, potentially leading to limited information disclosure, unauthorized data modification, or denial of service (process abort). The vulnerability's scope is limited to the vulnerable system with no subsequent system impact, and lateral movement potential is low given the local-only attack vector. In older, unpatched versions where the GGML_ASSERT guard is absent, the heap write is silent and could theoretically be leveraged for arbitrary code execution in the context of the llama.cpp process (Github Advisory).

A public proof-of-concept (PoC) repository has been published by researcher 3em0, including GDB scripts, probe scripts, and a Dockerfile for reproducing the vulnerability (PoC Repo). The CVSS v4.0 exploit maturity is rated as PROOF_OF_CONCEPT. There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is 0.00124 (approximately 0.12%), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and the CVE status is marked as "Deferred" (Github Advisory).

1. Reconnaissance: Identify a target system running a vulnerable version of llama.cpp (prior to b11796) with the Pocket-TTS (pockettts-gen) component accessible locally.
2. Craft malicious mmproj file: Create a malformed mmproj model projection file with crafted tensor metadata or state slot definitions that cause list_pockettts_state_slots to compute incorrect buffer sizes, as demonstrated in the public PoC repository (rescale_artifact.py, shot_scenario.json) (PoC Repo).
3. Trigger the vulnerability: Supply the malicious mmproj file as the mmproj argument to the Pocket-TTS tool (e.g., via command-line invocation of the relevant llama.cpp binary), causing list_pockettts_state_slots to process the malformed file.
4. Heap out-of-bounds write: On unpatched versions, the function writes beyond the allocated heap buffer without triggering any assertion, resulting in silent memory corruption. On versions b11796–b11871, a GGML_ASSERT fires and aborts the process instead.
5. Achieve objective: On vulnerable versions, the heap corruption may be leveraged for information disclosure, process crash (DoS), or — with additional exploitation primitives — arbitrary code execution in the context of the llama.cpp process (Github Advisory).

• File System: Presence of unexpected or externally sourced .gguf/mmproj files in directories used by llama.cpp Pocket-TTS tooling; files with anomalous tensor metadata or unusually small/large state slot definitions.
• Process: Abnormal termination of llama.cpp processes with GGML_ASSERT failure messages referencing state_out_* tensors or list_pockettts_state_slots; unexpected crashes or core dumps from llama.cpp binaries.
• Logs: Application logs containing error messages such as "graph has no \"state_out_<name>\" tensor" or assertion failures in clip.cpp or pockettts-gen.cpp; repeated process restarts of llama.cpp services.
• Network: Unexpected outbound connections from the host running llama.cpp following processing of an mmproj file (potential indicator of post-exploitation activity on unpatched versions).

Upgrade ggml-org/llama.cpp to version b11796 or later, which includes patch commit 0a1ef309cdbb9f2024f58a38fb4c42352c5db569 (Github Advisory, Patch Commit). As a workaround, restrict access to llama.cpp Pocket-TTS tools to trusted users only, and validate or allowlist mmproj files before processing. Note that while versions b11796–b11871 abort on malicious input via GGML_ASSERT, the root cause is not yet prevented by design; monitor PR #29360 for the by-construction fix. Avoid processing untrusted mmproj files in any version of llama.cpp until the by-construction fix is merged.

The vulnerability was noted in automated CVE tracking feeds and vulnerability databases shortly after disclosure, with no significant public researcher commentary or media coverage identified beyond the PoC repository published by 3em0 (PoC Repo). The GitHub Advisory Database classified it as Low severity and marked it as unreviewed. No major vendor statements or notable community debate has been observed.