Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
Related vulnerabilities
GHSA-56R5-2P2F-7CXP
Vulnerability from github – Published: 2026-07-17 21:19 – Updated: 2026-07-17 21:19Impact
The trie language model code introduced in PocketSphinx 5prealpha failed to check various boundary conditions when reading the headers of ARPA, DMP, and binary format language model files. In the case of invalid, corrupted or malicious input files, this could lead to stack and heap buffer overflows.
In addition, the acoustic model loading code (which is over 30 years old...) contains numerous instances of sscanf with an unbounded string field which could also lead to stack overflows in the case of corrupt or malicious inputs.
Because PocketSphinx will search the directory given by the POCKETSPHINX_PATH environment variable for acoustic and language model files, if this directory is writable by untrusted users, an attacker could corrupt an existing file or write a malicious one to this directory in order to trigger the vulnerability.
Patches
The problem has been corrected in PocketSphinx 5.1.1.
There is no patch currently available for users of Pocketsphinx 5prealpha, who are encouraged to migrate as soon as possible to PocketSphinx 5.1.1.
Workarounds
Ensure that the POCKETSPHINX_PATH environment variable is either unset, or set to a directory whose contents are trusted and which cannot be written by untrusted users.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pocketsphinx"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54559"
],
"database_specific": {
"cwe_ids": [
"CWE-119",
"CWE-121",
"CWE-122"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-17T21:19:17Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Impact\n\nThe trie language model code introduced in PocketSphinx 5prealpha failed to check various boundary conditions when reading the headers of ARPA, DMP, and binary format language model files. In the case of invalid, corrupted or malicious input files, this could lead to stack and heap buffer overflows.\n\nIn addition, the acoustic model loading code (which is over 30 years old...) contains numerous instances of `sscanf` with an unbounded string field which could also lead to stack overflows in the case of corrupt or malicious inputs.\n\nBecause PocketSphinx will search the directory given by the `POCKETSPHINX_PATH` environment variable for acoustic and language model files, if this directory is writable by untrusted users, an attacker could corrupt an existing file or write a malicious one to this directory in order to trigger the vulnerability.\n\n### Patches\n\nThe problem has been corrected in PocketSphinx 5.1.1.\n\nThere is no patch currently available for users of Pocketsphinx 5prealpha, who are encouraged to migrate as soon as possible to PocketSphinx 5.1.1.\n\n### Workarounds\n\nEnsure that the `POCKETSPHINX_PATH` environment variable is either unset, or set to a directory whose contents are trusted and which cannot be written by untrusted users.",
"id": "GHSA-56r5-2p2f-7cxp",
"modified": "2026-07-17T21:19:17Z",
"published": "2026-07-17T21:19:17Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/cmusphinx/pocketsphinx/security/advisories/GHSA-56r5-2p2f-7cxp"
},
{
"type": "PACKAGE",
"url": "https://github.com/cmusphinx/pocketsphinx"
},
{
"type": "WEB",
"url": "https://github.com/cmusphinx/pocketsphinx/releases/tag/v5.1.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "PocketSphinx: Buffer overflows in language and acoustic model loading code"
}
PYSEC-2026-3498
Vulnerability from pysec - Published: 2026-07-23 11:41 - Updated: 2026-07-23 14:32Impact
The trie language model code introduced in PocketSphinx 5prealpha failed to check various boundary conditions when reading the headers of ARPA, DMP, and binary format language model files. In the case of invalid, corrupted or malicious input files, this could lead to stack and heap buffer overflows.
In addition, the acoustic model loading code (which is over 30 years old...) contains numerous instances of sscanf with an unbounded string field which could also lead to stack overflows in the case of corrupt or malicious inputs.
Because PocketSphinx will search the directory given by the POCKETSPHINX_PATH environment variable for acoustic and language model files, if this directory is writable by untrusted users, an attacker could corrupt an existing file or write a malicious one to this directory in order to trigger the vulnerability.
Patches
The problem has been corrected in PocketSphinx 5.1.1.
There is no patch currently available for users of Pocketsphinx 5prealpha, who are encouraged to migrate as soon as possible to PocketSphinx 5.1.1.
Workarounds
Ensure that the POCKETSPHINX_PATH environment variable is either unset, or set to a directory whose contents are trusted and which cannot be written by untrusted users.
| Name | purl | pocketsphinx | pkg:pypi/pocketsphinx |
|---|
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pocketsphinx",
"purl": "pkg:pypi/pocketsphinx"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.0.1",
"0.0.2",
"0.0.3",
"0.0.4",
"0.0.5",
"0.0.6",
"0.0.7",
"0.0.8",
"0.0.9",
"0.1.0",
"0.1.10",
"0.1.11",
"0.1.12",
"0.1.15",
"0.1.3",
"0.1.5",
"0.1.7",
"0.1.9",
"5.0.0",
"5.0.0rc3",
"5.0.0rc4",
"5.0.0rc5",
"5.0.1",
"5.0.2",
"5.0.3",
"5.0.4",
"5.1.0",
"5.1.0rc1",
"5.1.0rc2"
]
}
],
"aliases": [
"CVE-2026-54559",
"GHSA-56r5-2p2f-7cxp"
],
"details": "### Impact\n\nThe trie language model code introduced in PocketSphinx 5prealpha failed to check various boundary conditions when reading the headers of ARPA, DMP, and binary format language model files. In the case of invalid, corrupted or malicious input files, this could lead to stack and heap buffer overflows.\n\nIn addition, the acoustic model loading code (which is over 30 years old...) contains numerous instances of `sscanf` with an unbounded string field which could also lead to stack overflows in the case of corrupt or malicious inputs.\n\nBecause PocketSphinx will search the directory given by the `POCKETSPHINX_PATH` environment variable for acoustic and language model files, if this directory is writable by untrusted users, an attacker could corrupt an existing file or write a malicious one to this directory in order to trigger the vulnerability.\n\n### Patches\n\nThe problem has been corrected in PocketSphinx 5.1.1.\n\nThere is no patch currently available for users of Pocketsphinx 5prealpha, who are encouraged to migrate as soon as possible to PocketSphinx 5.1.1.\n\n### Workarounds\n\nEnsure that the `POCKETSPHINX_PATH` environment variable is either unset, or set to a directory whose contents are trusted and which cannot be written by untrusted users.",
"id": "PYSEC-2026-3498",
"modified": "2026-07-23T14:32:26.189016Z",
"published": "2026-07-23T11:41:47.547360Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/cmusphinx/pocketsphinx/security/advisories/GHSA-56r5-2p2f-7cxp"
},
{
"type": "PACKAGE",
"url": "https://github.com/cmusphinx/pocketsphinx"
},
{
"type": "WEB",
"url": "https://github.com/cmusphinx/pocketsphinx/releases/tag/v5.1.1"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/pocketsphinx"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-56r5-2p2f-7cxp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54559"
}
],
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "PocketSphinx: Buffer overflows in language and acoustic model loading code"
}