{"items":[{"id":"NVI-00016102","kind":"vulnerability","title":"PocketSphinx: Buffer overflows in language and acoustic model loading code","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-56r5-2p2f-7cxp","CVE-2026-54559"],"plain_summary":"GitHub lists this reviewed advisory for pocketsphinx. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-54fc2b68cfa3e24181446d93a317860f"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-30T17:51:36.337Z","value":"6.9 MEDIUM (4.0)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-54fc2b68cfa3e24181446d93a317860f"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-21af237bc84d9f9f5b4e33450c4f9efc","url":"https://github.com/advisories/GHSA-56r5-2p2f-7cxp","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-56r5-2p2f-7cxp","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T02:49:06.528Z"},{"id":"sr-54fc2b68cfa3e24181446d93a317860f","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54559","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-54559","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-08T01:48:19.229Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-21af237bc84d9f9f5b4e33450c4f9efc"],"technology":"pocketsphinx","known_exclusions":[],"conditions_summary":"### Impact\n\nThe trie language model code introduced in PocketSphinx 5prealpha failed to check various boundary conditions when reading the headers of ARPA, DMP, and binary format language model files.  In the case of invalid, corrupted or malicious input files, this could lead to stack and heap buffer overflows.\n\nIn addition, the acoustic model loading code (which is over 30 years old...) contains numerous instances of `sscanf` with an unbounded string field which could also lead to stack overflows in the case of corrupt or malicious inputs.\n\nBecause PocketSphinx will search the directory given by the `POCKETSPHINX_PATH` environment variable for acoustic and language model files, if this directory is writable by untrusted users, an attacker could corrupt an existing file or write a malicious one to this directory in order to trigger the vulnerability.\n\n### Patches\n\nThe problem has been corrected in PocketSphinx 5.1.1.\n\nThere is no patch currently available for users of Pocketsphinx 5prealpha, who are encouraged to migrate as soon as possible to  PocketSphinx 5.1.1.\n\n### Workarounds\n\nEnsure that the `POCKETSPHINX_PATH` environment variable is either unset, or set to a directory whos","public_affected_ranges":["< 5.1.1"]}],"null_published_at":"2026-11-08T19:53:44.057Z","source_updated_at":"2026-07-17T21:19:18.000Z","source_disclosed_at":"2026-07-17T21:19:17.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-04T02:49:06.528Z"},{"id":"NVI-00016102","kind":"vulnerability","title":"PocketSphinx: Buffer overflows in language and acoustic model loading code","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-56r5-2p2f-7cxp","CVE-2026-54559"],"plain_summary":"GitHub lists this reviewed advisory for pocketsphinx. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-21af237bc84d9f9f5b4e33450c4f9efc"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-21af237bc84d9f9f5b4e33450c4f9efc","url":"https://github.com/advisories/GHSA-56r5-2p2f-7cxp","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-56r5-2p2f-7cxp","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T02:49:06.528Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-21af237bc84d9f9f5b4e33450c4f9efc"],"technology":"pocketsphinx","known_exclusions":[],"conditions_summary":"### Impact\n\nThe trie language model code introduced in PocketSphinx 5prealpha failed to check various boundary conditions when reading the headers of ARPA, DMP, and binary format language model files.  In the case of invalid, corrupted or malicious input files, this could lead to stack and heap buffer overflows.\n\nIn addition, the acoustic model loading code (which is over 30 years old...) contains numerous instances of `sscanf` with an unbounded string field which could also lead to stack overflows in the case of corrupt or malicious inputs.\n\nBecause PocketSphinx will search the directory given by the `POCKETSPHINX_PATH` environment variable for acoustic and language model files, if this directory is writable by untrusted users, an attacker could corrupt an existing file or write a malicious one to this directory in order to trigger the vulnerability.\n\n### Patches\n\nThe problem has been corrected in PocketSphinx 5.1.1.\n\nThere is no patch currently available for users of Pocketsphinx 5prealpha, who are encouraged to migrate as soon as possible to  PocketSphinx 5.1.1.\n\n### Workarounds\n\nEnsure that the `POCKETSPHINX_PATH` environment variable is either unset, or set to a directory whos","public_affected_ranges":["< 5.1.1"]}],"null_published_at":"2026-11-04T10:04:27.891Z","source_updated_at":"2026-07-17T21:19:18.000Z","source_disclosed_at":"2026-07-17T21:19:17.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-04T02:49:06.528Z"}],"next_cursor":null,"snapshot_revision":"42594"}