{"cve":"CVE-2026-54559","nvd":{"published":"2026-09-14T20:16:46.573","modified":"2026-09-30T17:51:36.337","status":"Awaiting Analysis","description":"PocketSphinx is a small speech recognizer. Prior to 5.1.1, the trie language-model loaders in src/lm/ngram_model_trie.c do not adequately validate boundary conditions in ARPA, DMP, and binary format headers, and the acoustic-model loaders in src/mdef.c and src/util/bio.c use sscanf with unbounded string fields. Loading an invalid, corrupted, or malicious language or acoustic model can therefore cause stack or heap buffer overflows and memory corruption. An attacker who can write to a directory selected by POCKETSPHINX_PATH can replace or add a model file that PocketSphinx later loads; users of PocketSphinx 5prealpha have no backported patch and must migrate to the fixed release. This issue is fixed in version 5.1.1.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","score":6.9},"cvss_v3":null,"cwes":["CWE-119","CWE-121","CWE-122"],"references":["https://github.com/cmusphinx/pocketsphinx/commit/2a3c03788a9973eff548664334fb781e9f4ad4a5","https://github.com/cmusphinx/pocketsphinx/releases/tag/v5.1.1","https://github.com/cmusphinx/pocketsphinx/security/advisories/GHSA-56r5-2p2f-7cxp"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:53:43.293028046+00:00"},"epss":{"cve":"CVE-2026-54559","score":0.00548,"percentile":0.45607,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-56r5-2p2f-7cxp","url":"https://osv.dev/vulnerability/GHSA-56r5-2p2f-7cxp","summary":"PocketSphinx: Buffer overflows in language and acoustic model loading code","modified":"2026-07-23T15:11:41.729117360Z","packages":[{"ecosystem":"PyPI","name":"pocketsphinx","purl":"pkg:pypi/pocketsphinx","ranges":["<5.1.1"],"fixed":["5.1.1"]}]},{"id":"PYSEC-2026-3498","url":"https://osv.dev/vulnerability/PYSEC-2026-3498","summary":"PocketSphinx: Buffer overflows in language and acoustic model loading code","modified":"2026-07-23T15:00:20.035217737Z","packages":[{"ecosystem":"PyPI","name":"pocketsphinx","purl":"pkg:pypi/pocketsphinx","ranges":["<5.1.1"],"fixed":["5.1.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}