PSA: llama.cpp CVE-2026-116096 Vulnerability in Pocket-TTS
A public vulnerability (CVE-2026-116096) involving an out-of-bounds write in llama.cpp's Pocket-TTS component has been identified, where a malformed mmproj file can trigger a heap out-of-bounds write. While current master branches and release b11871 now catch this with a GGML_ASSERT abort instead of a silent exploit, users are advised to upgrade to version b11796 or later. This security advisory is crucial for users running local AI models since llama.cpp serves as the de facto standard backend for many local inference tools and applications. Malformed model files could potentially be leveraged by attackers with local access to disrupt systems or execute unintended behavior. The vulnerability resides in the function list_pockettts_state_slots within tools/mtmd/models/pockettts-gen.cpp. Current mitigations rely on runtime crash assertions (GGML_ASSERT) rather than a complete architectural fix, as the recommended prevention patch in pull request #29360 remains open.
## BACKGROUND
llama.cpp is a widely used open-source software library designed to perform efficient inference on large language models alongside the GGML tensor library. An out-of-bounds write occurs when a program attempts to write data past the end of a designated buffer, potentially corrupting memory or causing application crashes.