𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗔𝗹𝗲𝗿𝘁: 𝗹𝗹𝗮𝗺𝗮.𝗰𝗽𝗽 𝗖𝗩𝗘-𝟮𝟬𝟮𝟲-𝟭𝟭𝟲𝟬𝟵𝟲 ⠀ A vulnerability in llama.cpp's Pocket-TTS component can trigger a heap out-of-bounds write when processing a malicious `mmproj` argument. ⠀ 𝗪𝗵𝗮𝘁 𝗱𝗲𝘃𝗲𝗹𝗼𝗽𝗲𝗿𝘀 𝘀𝗵𝗼𝘂𝗹𝗱 𝗸𝗻𝗼𝘄: ⠀ • The issue involves potentially unsafe memory access. • Exploitation requires local access, according to the advisory. • The reported fix targets version b11796. • Later builds reportedly detect the condition and abort, but that is not the same as preventing the underlying unsafe access by design. ⠀ If you use llama.cpp, review the advisory and update to a patched release. Avoid loading untrusted model-related files until you've verified your version and mitigations. ⠀ CVE details: https://nvd.nist.gov/vuln/detail/CVE-2026-116096 ⠀ #Cybersecurity #AI #LLM #LlamaCpp #OpenSource
