EUVD-2026-109577

A weakness has been identified in ggml-org llama.cpp. Affected by this issue is the function listpocketttsstateslots of the file tools/mtmd/models/pockettts-gen.cpp of the component Pocket-TTS. This manipulation of the argument mmproj causes out-of-bounds write. The attack requires local access...

CVE-2026-116096

A weakness has been identified in ggml-org llama.cpp. Affected by this issue is the function listpocketttsstateslots of the file tools/mtmd/models/pockettts-gen.cpp of the component Pocket-TTS. This manipulation of the argument mmproj causes out-of-bounds write. The attack requires local access...

CVE-2026-116096 ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write

A weakness has been identified in ggml-org llama.cpp. Affected by this issue is the function listpocketttsstateslots of the file tools/mtmd/models/pockettts-gen.cpp of the component Pocket-TTS. This manipulation of the argument mmproj causes out-of-bounds write. The attack requires local access...

CVE-2026-116096

A heap out-of-bounds write vulnerability exists in the Pocket-TTS component of ggml-org llama.cpp . The flaw is located in the list_pockettts_state_slots function within the file tools/mtmd/models/pockettts-gen.cpp, caused by the manipulation of the mmproj argument. This issue requires local acce...