llama.cpp EUVD-2026-109577

Exploitation requires local access with low privileges (PR:L) and that the target host loads an attacker-controlled or malformed mmproj (multimodal projector) file through llama.cpp's Pocket-TTS audio-generation / gen-audio state_out path (the list_pockettts_state_slots function in tools/mtmd/models/pockettts-gen.cpp). The decisive prerequisite is that the victim process ingests an untrusted mmproj file while using the Pocket-TTS TTS feature - a non-default, specialized workflow, not a core inference path. Limiting factors: no remote/network vector (AV:L), the operator must actively load the malicious model file, and on release b11871 and current master the malformed file no longer causes a silent exploitable write but instead trips a release-active GGML_ASSERT and aborts, reducing impact to a controlled abort rather than arbitrary heap corruption.

All available signals point to this being a genuinely low-priority issue rather than a high-CVSS inflation case. The CVSS 4.0 vector is AV:L (local attack vector), AC:L, AT:N, PR:L (requires local low-privilege access), UI:N, with only Low confidentiality, integrity and availability impact (VC:L/VI:L/VA:L) and no subsequent-system impact, yielding a base score of just 1.9. This is not a KEV entry - there is no indication of confirmed active exploitation. EPSS is not provided in the input, so exploitation probability cannot be quantified. A public PoC reference exists but is explicitly flagged as not verified as working exploit code, and the vuln.today Decision label is 'monitor' - the lowest actionable tier - which is consistent with the low CVSS and local-only vector. Note a conflict in the source data: the NVD-style Description states 'The exploit has been made available to the public and could be used for attacks,' while the multi-source intelligence qualifies the same artifact as 'reference only, not verified as working exploit code' - treat the PoC as unverified. A further mitigating nuance from the evidence: on current master and release b11871 the malformed-mmproj condition now trips a release-active GGML_ASSERT and aborts rather than performing a silent exploitable heap write, so the condition is detected-and-aborted (a denial-of-service-style abort) rather than prevented by design; the submitter's by-construction fix (PR #29360) remains open. Overall this is a low real-world priority: local access and operator-supplied model files are required, impacts are rated Low, and there is no confirmed exploitation.

An attacker who can place or substitute a crafted multimodal projector (mmproj) model file that is then loaded by a victim's llama.cpp Pocket-TTS audio-generation workflow triggers an out-of-bounds heap write in list_pockettts_state_slots / the gen-audio state_out path. Because the CVSS vector is AV:L/PR:L, this requires local access and low-level privileges on the host - it is not a remote network attack. A public PoC reference exists but is not verified as working exploit code, and on b11871/master the malformed file now causes a GGML_ASSERT abort rather than a silent memory write.