# CVE-2026-116096: ggml-org llama.cpp out-of-bounds write in Pocket-TTS

Source: https://junglewise.ai/threats/cve-2026-116096-a-weakness-has-been-identified-in-ggml-org-llama-cpp-affected-by  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-25. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-116096 · Severity: medium · CVSS 5.3 · Published 2026-10-25

llama.cpp is a machine learning inference library used to run large language models locally. An out-of-bounds memory write vulnerability in its Pocket-TTS audio generation component could allow a local attacker to corrupt memory and potentially crash the application or execute arbitrary code by supplying a malicious mmproj model file.

Technologies: [Ggml-Org Llama.Cpp](https://junglewise.ai/threats/technologies/ggml-org-llama-cpp). Vendors: [Ggml-Org](https://junglewise.ai/threats/vendors/ggml-org).

## Quick answers

**Is CVE-2026-116096 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116096 being exploited in the wild.

**How severe is CVE-2026-116096?** Medium severity, with a CVSS score of 5.3, published 25 October 2026.

**Which products and versions are affected?** Ggml-Org Llama.Cpp before b11796.

**Is there a fix for CVE-2026-116096?** Yes: fixed in llama.cpp b11796. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116096 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-116096?** Check whether you run Ggml-Org Llama.Cpp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in llama.cpp b11796

## Technical details

The list_pockettts_state_slots function in tools/mtmd/models/pockettts-gen.cpp contains a heap out-of-bounds write when processing a malicious mmproj argument. An attacker with local access can trigger this by providing a crafted mmproj file. Current master branch and release b11871 mitigate the issue by detecting the condition and aborting with an assertion, but the underlying vulnerability is caught at runtime rather than prevented by design.

## Affected products

- ggml-org llama.cpp before b11796

## Timeline

- 2026-10-25: disclosed
- 2026-10-25: patched: Patch 0a1ef309cdbb9f2024f58a38fb4c42352c5db569 available; runtime detection via GGML_ASSERT in b11871

## References

- [https://github.com/3em0/cve_repo/tree/main/2026/llama.cpp.pockettts_state_heap_oob_rce](https://github.com/3em0/cve_repo/tree/main/2026/llama.cpp.pockettts_state_heap_oob_rce)
- [https://github.com/3em0/cve_repo/tree/main/2026/llama.cpp.pockettts_state_heap_oob_rce/poc](https://github.com/3em0/cve_repo/tree/main/2026/llama.cpp.pockettts_state_heap_oob_rce/poc)

## Related threats

- [llama.cpp ggml-rpc server denial of service](https://junglewise.ai/threats/cve-2026-119052-llama-cpp-b2877-before-b11935-contains-an-uncaught-exception)
- [llama.cpp out-of-bounds write in ggml-rpc RDMA transport](https://junglewise.ai/threats/cve-2026-118375-llama-cpp-b8841-before-b11865-contains-an-out-of-bounds-write)
- [llama.cpp integer overflow in gguf_init_from_reader](https://junglewise.ai/threats/cve-2026-116829-llama-cpp-b10398-before-b11301-contains-an-integer-overflow)
- [llama.cpp heap out-of-bounds write in PLAMO2 tokenizer](https://junglewise.ai/threats/cve-2026-116816-llama-cpp-b5899-before-b10261-contains-a-heap-out-of-bounds)
- [llama.cpp heap out-of-bounds read in tokenizer loading](https://junglewise.ai/threats/cve-2025-71439-llama-cpp-before-b5649-contains-a-heap-out-of-bounds-read)