Heap-based Buffer Overflow Affecting pocketsphinx package, versions [,5.1.1)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-POCKETSPHINX-18319703
- published26 Jul 2026
- disclosed17 Jul 2026
- creditUnknown
Introduced: 17 Jul 2026
NewCVE-2026-54559 (opens in a new tab)How to fix?
Upgrade pocketsphinx to version 5.1.1 or higher.
Overview
pocketsphinx is an Official Python bindings for PocketSphinx
Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the model loading process. An attacker can execute arbitrary code or cause a crash by supplying a crafted or malicious language or acoustic model file to the application. This is only exploitable if the directory specified by the POCKETSPHINX_PATH environment variable is writable by untrusted users.
Workaround
This vulnerability can be mitigated by ensuring that the POCKETSPHINX_PATH environment variable is either unset or set to a directory that is trusted and not writable by untrusted users.