CVE-2026-54559: 
Python vulnerability analysis and mitigation

CVE-2026-54559 is a buffer overflow vulnerability in PocketSphinx, an open-source speech recognition library, affecting the language and acoustic model loading code. The trie language model code introduced in PocketSphinx 5prealpha fails to validate boundary conditions when parsing ARPA, DMP, and binary format language model file headers, and the acoustic model loading code contains unbounded sscanf string fields. All versions prior to 5.1.1 (including 5prealpha) are affected. The vulnerability was originally published on June 6, 2026, by maintainer dhdaines, and added to the GitHub Advisory Database on July 17, 2026. It carries a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory).

The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-121 (Stack-based Buffer Overflow), and CWE-122 (Heap-based Buffer Overflow). Two distinct code paths are affected: (1) the trie language model parser, which does not enforce boundary checks on headers of ARPA, DMP, and binary model files, enabling stack and heap overflows via malformed or malicious files; and (2) the legacy acoustic model loading code (~30 years old), which uses sscanf with unbounded string format specifiers, enabling stack overflows from oversized input fields. The attack surface is widened by PocketSphinx's behavior of automatically searching the directory specified by the POCKETSPHINX_PATH environment variable for model files — if this directory is writable by untrusted users, an attacker can plant or corrupt model files to trigger the vulnerability (GitHub Advisory, PocketSphinx Release).

Successful exploitation could result in stack or heap memory corruption, potentially leading to application crashes or arbitrary code execution in the context of the process running PocketSphinx. The primary integrity impact is on the vulnerable system, with no direct confidentiality or availability impact assessed in the CVSS v4.0 scoring. In environments where PocketSphinx processes model files from shared or user-writable directories, the risk of exploitation is elevated, particularly in multi-user systems or applications that expose speech recognition functionality to untrusted inputs (GitHub Advisory).

1. Identify target: Locate a system running PocketSphinx versions prior to 5.1.1 (including 5prealpha) where the POCKETSPHINX_PATH environment variable points to a directory writable by untrusted users, or where the application processes externally supplied model files.
2. Craft malicious model file: Create a malformed ARPA, DMP, or binary language model file with invalid or oversized header fields that violate the boundary conditions expected by the trie language model parser, or craft an acoustic model file with an oversized string field exploiting the unbounded sscanf format specifier.
3. Place or deliver the file: Write the malicious file to the POCKETSPHINX_PATH directory (if writable), replace an existing model file, or supply the file through any application interface that passes model files to PocketSphinx.
4. Trigger model loading: Cause the application to load the malicious model file — this occurs automatically when PocketSphinx initializes or when a speech recognition session begins.
5. Achieve memory corruption: The malformed input triggers a stack or heap buffer overflow during parsing, potentially enabling application crash or, with further exploitation, arbitrary code execution in the process context (GitHub Advisory).

• File System: Unexpected or recently modified ARPA (.arpa), DMP (.dmp), or binary language model files in the POCKETSPHINX_PATH directory; acoustic model files with anomalously large string fields.
• Logs: Application crash logs or core dumps originating from PocketSphinx model loading routines (sscanf, trie parser); segmentation fault signals from the PocketSphinx process during initialization.
• Process: Unexpected termination or crash of processes using PocketSphinx during model loading phase; unusual child processes spawned after a crash if exploit achieves code execution.

Upgrade to PocketSphinx 5.1.1, which corrects the boundary condition checks in the language model parser and the unbounded sscanf calls in the acoustic model loader. Users of PocketSphinx 5prealpha should migrate to 5.1.1 as no backport patch is available for that branch. As an immediate workaround, ensure the POCKETSPHINX_PATH environment variable is either unset or points to a directory whose contents are trusted and not writable by untrusted users (GitHub Advisory, PocketSphinx Release).

The vulnerability was reported by researcher "damseleng" and acknowledged by PocketSphinx maintainer dhdaines, who released the fix in version 5.1.1 with a note that "all users are recommended to upgrade." No significant broader media coverage or notable community commentary beyond the GitHub advisory and release notes has been identified (PocketSphinx Release).