CVE-2026-54559: PocketSphinx Buffer Overflows Vulnerability

MODERATE
Advisory Identifier: GHSA-56r5-2p2f-7cxp
Share
CWE-121 CWE-122 CWE-119
Published
Advisory Summary

CVE-2026-54559 is a MODERATE buffer overflows vulnerability (CWE-121: Stack-based Buffer Overflow) affecting PocketSphinx libraries in the PyPI ecosystem. The issue involves buffer overflows in language and acoustic model loading code. Remediation is available by upgrading affected packages to version 5.1.1.

CVE-2026-54559 at a Glance

CVE Identifier CVE-2026-54559
GHSA Identifier GHSA-56r5-2p2f-7cxp
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification CWE-121: Stack-based Buffer Overflow
Affected Product PocketSphinx
Package Ecosystem PyPI
Published Date
Last Updated

How to Fix CVE-2026-54559

To remediate this vulnerability, upgrade all affected PocketSphinx dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

pocketsphinx fixed: 5.1.1 
pip install pocketsphinx>=5.1.1
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

pip show pocketsphinx

How to Check if You Are Affected

To determine whether your Python environment is affected by CVE-2026-54559, inspect your installed packages using pip:

pip show pocketsphinx

Analyze the terminal output to locate any version of PocketSphinx in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 5.1.1), your application is affected.

Note: The pip show pocketsphinx command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-121: Stack-based Buffer Overflow, where a stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). In PocketSphinx, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact The trie language model code introduced in PocketSphinx 5prealpha failed to check various boundary conditions when reading the headers of ARPA, DMP, and binary format language model files. In the case of invalid, corrupted or malicious input files, this could lead to stack and heap buffer overflows. In addition, the acoustic model loading code (which is over 30 years old...) contains numerous instances of `sscanf` with an unbounded string field which could also lead to stack overflows in the case of corrupt or malicious inputs. Because PocketSphinx will search the directory given by the `POCKETSPHINX_PATH` environment variable for acoustic and language model files, if this directory is writable by untrusted users, an attacker could corrupt an existing file or write a malicious one to this directory in order to trigger the vulnerability. ### Patches The problem has been corrected in PocketSphinx 5.1.1. There is no patch currently available for users of Pocketsphinx 5prealpha, who are encouraged to migrate as soon as possible to PocketSphinx 5.1.1. ### Workarounds Ensure that the `POCKETSPHINX_PATH` environment variable is either unset, or set to a directory whose contents are trusted and which cannot be written by untrusted users.

CVE-2026-54559 Affected PocketSphinx Versions

1 component(s)
Fixed Versions:
5.1.1
Product / Package Ecosystem Affected Versions Fixed Version
pocketsphinx
pypi/pocketsphinx
PyPI
< 5.1.1
5.1.1

References

GitHub Advisory / Wiki ADVISORY
https://github.com/cmusphinx/pocketsphinx/security/advisories/GHSA-56r5-2p2f-7cxp
PocketSphinx Source Repository REPOSITORY
https://github.com/cmusphinx/pocketsphinx
PocketSphinx Release RELEASE
https://github.com/cmusphinx/pocketsphinx/releases/tag/v5.1.1

Frequently Asked Questions

What is CVE-2026-54559?
CVE-2026-54559 is a security vulnerability in PocketSphinx involving Buffer overflows in language and acoustic model loading code under CWE-121: Stack-based Buffer Overflow.
Which PocketSphinx versions are affected?
Affected versions include releases prior to 5.1.1 across affected packages: pocketsphinx.
What version fixes CVE-2026-54559?
Upgrading to 5.1.1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is pocketsphinx affected?
Yes, pocketsphinx is affected in releases prior to 5.1.1. Upgrade your dependency to 5.1.1 or later.
What CWE is associated with CVE-2026-54559?
CVE-2026-54559 is classified under CWE-121: Stack-based Buffer Overflow (A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).).
How can I check PyPI dependencies for CVE-2026-54559?
Run the dependency tree command: 'pip show pocketsphinx'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-56r5-2p2f-7cxp",
  "modified" : "2026-07-17T21:19:17Z",
  "published" : "2026-07-17T21:19:17Z",
  "aliases" : [ "CVE-2026-54559" ],
  "summary" : "PocketSphinx: Buffer overflows in language and acoustic model loading code",
  "details" : "### Impact\n\nThe trie language model code introduced in PocketSphinx 5prealpha failed to check various boundary conditions when reading the headers of ARPA, DMP, and binary format language model files.  In the case of invalid, corrupted or malicious input files, this could lead to stack and heap buffer overflows.\n\nIn addition, the acoustic model loading code (which is over 30 years old...) contains numerous instances of `sscanf` with an unbounded string field which could also lead to stack overflows in the case of corrupt or malicious inputs.\n\nBecause PocketSphinx will search the directory given by the `POCKETSPHINX_PATH` environment variable for acoustic and language model files, if this directory is writable by untrusted users, an attacker could corrupt an existing file or write a malicious one to this directory in order to trigger the vulnerability.\n\n### Patches\n\nThe problem has been corrected in PocketSphinx 5.1.1.\n\nThere is no patch currently available for users of Pocketsphinx 5prealpha, who are encouraged to migrate as soon as possible to  PocketSphinx 5.1.1.\n\n### Workarounds\n\nEnsure that the `POCKETSPHINX_PATH` environment variable is either unset, or set to a directory whose contents are trusted and which cannot be written by untrusted users.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "pocketsphinx"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "5.1.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/cmusphinx/pocketsphinx/security/advisories/GHSA-56r5-2p2f-7cxp"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/cmusphinx/pocketsphinx"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/cmusphinx/pocketsphinx/releases/tag/v5.1.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-119", "CWE-121", "CWE-122" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-17T21:19:17Z",
    "nvd_published_at" : null
  }
}