CVE-2026-116096

🗓️ 25 Oct 2026 23:00:24Reported by VulDBType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 21 Views

Local out-of-bounds write in ggml-org llama.cpp Pocket-TTS via mmproj argument.

Reporter	Title	Published	Views	Family All 7
Circl	CVE-2026-116096	25 Oct 202623:16	–	circl
Cvelist	CVE-2026-116096 ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write	25 Oct 202623:00	–	cvelist
EUVD	EUVD-2026-109577	26 Oct 202600:32	–	euvd
Mend	CVE-2026-116096	25 Oct 202623:00	–	mend
NVD	CVE-2026-116096	25 Oct 202623:17	–	nvd
Positive Technologies	PT-2026-123122	25 Oct 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-116096 ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write	25 Oct 202623:00	–	vulnrichment

Vulners

Node

ggml llama.cppMatch0.4.0

ggml llama.cppMatch0.17.1

ggml llama.cppMatchb5693

ggml llama.cppMatchb7445

ggml llama.cppMatchb7824

ggml llama.cppMatchb8492

ggml llama.cppMatchb8585

ggml llama.cppMatchb9058

ggml llama.cppMatchb9060

[
  {
    "vendor": "ggml-org",
    "product": "llama.cpp",
    "versions": [
      {
        "version": "0.4.0",
        "status": "affected"
      },
      {
        "version": "0.17.1",
        "status": "affected"
      },
      {
        "version": "55abc39",
        "status": "affected"
      },
      {
        "version": "55d4206c8",
        "status": "affected"
      },
      {
        "version": "b5693",
        "status": "affected"
      },
      {
        "version": "b7445",
        "status": "affected"
      },
      {
        "version": "b7824",
        "status": "affected"
      },
      {
        "version": "b8492",
        "status": "affected"
      },
      {
        "version": "b8585",
        "status": "affected"
      },
      {
        "version": "b9058",
        "status": "affected"
      },
      {
        "version": "b9060",
        "status": "affected"
      },
      {
        "version": "b11796",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:2.3:a:ggml-org:llama.cpp:*:*:*:*:*:*:*:*"
    ],
    "modules": [
      "Pocket-TTS"
    ]
  }
]

Source	Link
github	www.github.com/ggml-org/llama.cpp/
vuldb	www.vuldb.com/vuln/426164
github	www.github.com/3em0/cve_repo/tree/main/2026/llama.cpp.pockettts_state_heap_oob_rce/poc
github	www.github.com/ggml-org/llama.cpp/commit/0a1ef309cdbb9f2024f58a38fb4c42352c5db569
github	www.github.com/ggml-org/llama.cpp/pull/30902
github	www.github.com/3em0/cve_repo/tree/main/2026/llama.cpp.pockettts_state_heap_oob_rce
github	www.github.com/ggml-org/llama.cpp/releases/tag/b11796
vuldb	www.vuldb.com/cve/CVE-2026-116096
vuldb	www.vuldb.com/submit/1000891
vuldb	www.vuldb.com/vuln/426164/cti

26 Oct 2026 17:17Current

5.3Medium risk

Vulners AI Score5.3

CVSS 24.3

CVSS 44.8

CVSS 3.15.3

CVSS 35.3

EPSS0.00124

SSVC