News · 2026-10-26

llama.cpp advisory flags a crafted Pocket-TTS model-file risk

A llama.cpp security advisory published October 26 identifies a local out-of-bounds write in the Pocket-TTS path when an untrusted mmproj file is loaded. The dossier recommends b11796 or later for users of that workflow. A later advisory update says current master and b11871 abort on the malformed input while the root cause remains, so the update should not be described as proof of a complete fix.

Key facts

• The advisory is CVE-2026-116096, published October 26, 2026, in the GitHub Advisory Database.
• It identifies the Pocket-TTS function list_pockettts_state_slots and a crafted local mmproj input.
• The actionable build references are b11796 and the later b11871 update; the formal affected and patched version ranges remain unspecified.
• The primary source is the advisory, supported by the upstream change.

Local AI is often described as a way to reduce dependence on outside services. That does not remove the software boundary between an inference program and the files it reads. A downloadable model component is input to a parser and runtime. Those programs still have to validate what the input says about its structure and the memory they allocate for it.

The reported defect is an out-of-bounds write: the program writes beyond the memory region intended for an operation. A useful analogy is a clerk filing information into a cabinet whose labels claim it has more compartments than it actually does. If the clerk trusts the labels without checking the cabinet, a later entry can be put somewhere it does not belong.

That analogy describes the class of memory-safety problem, not a complete reconstruction of this particular bug. The advisory names the Pocket-TTS state-slot path. The dossier does not establish a remote delivery mechanism, a successful arbitrary-code execution chain, or exploitation in the wild. Those are separate claims that require separate evidence.

The narrow scope is important for response. The warning is relevant to people using Pocket-TTS generation with an untrusted mmproj file. It is not evidence that every text-generation session in llama.cpp is exposed through the same path. Likewise, a person running a server is not automatically shown to be remotely exploitable merely because the underlying program has a local file-loading defect.

GitHub's advisory marks the affected and patched version information as “unknown.” That field should not be silently replaced with a broad invented vulnerable range. The dossier checked an upstream pull request and the b11796 release, which supply concrete update references, but version guidance and a formally enumerated exposure range are different pieces of information.

The subsequent b11871 release reference matters because the advisory's update describes aborting on the malformed input while saying the root cause remains. Stopping a dangerous operation can reduce one observed consequence. It does not establish that every path to the underlying defect has been removed. A careful report preserves that distinction instead of compressing it into a simple fixed-or-unfixed slogan.

The broader AI connection is the model supply chain. People routinely exchange checkpoints, conversions, and companion files because local inference depends on artifacts produced by multiple maintainers. That creates several places to ask what is being trusted: the upstream model, the conversion process, the file host, and the inference runtime. This advisory concerns runtime handling of a crafted artifact; it does not establish that any named distributor deliberately poisoned a release.

Our lesson on model file formats explains why a model download contains structured data rather than a single abstract mathematical object. File formats and memory safety are related but different subjects. Choosing a format with desirable properties does not prove that every implementation handling that format or its companion files is free of parsing defects.

For affected operators, the immediate response supported by the dossier is to update the relevant runtime and reassess whether untrusted files need to be loaded in that workflow. Broader containment decisions depend on the deployment. The point is to respond to the verified path and current advisory, rather than to an imagined universal emergency.

No independent exploitation report or broad community validation is established in the supplied material. The strongest caveat is therefore also the useful conclusion: this is a specific local model-input vulnerability with imperfect version metadata and a qualified update state. It demonstrates why local AI's security boundary includes ordinary native software and artifact provenance, not just the behavior of the language model.

Primary source, verified: read the paper →

Ground Truth. (2026, October 26). llama.cpp advisory flags a crafted Pocket-TTS model-file risk. Ground Truth. https://groundtruth.day/news/llama-cpp-pocket-tts-advisory-untrusted-mmproj.html

@misc{groundtruth:llama-cpp-pocket-tts-advisory-untrusted-mmproj,
  title  = {llama.cpp advisory flags a crafted Pocket-TTS model-file risk},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {oct},
  url    = {https://groundtruth.day/news/llama-cpp-pocket-tts-advisory-untrusted-mmproj.html}
}

Topics: cybersecurity · ai-security · vulnerabilities · supply-chain · local-ai