PocketSphinx is a small speech recognizer. Prior to 5.1.1, the trie language-model loaders in src/lm/ngram_model_trie.c do not adequately validate boundary conditions in ARPA, DMP, and binary format headers, and the acoustic-model loaders in src/mdef.c and src/util/bio.c use sscanf with unbounded string fields. Loading an invalid, corrupted, or malicious language or acoustic model can therefore cause stack or heap buffer overflows and memory corruption. An attacker who can write to a directory selected by POCKETSPHINX_PATH can replace or add a model file that PocketSphinx later loads; users of PocketSphinx 5prealpha have no backported patch and must migrate to the fixed release. This issue is fixed in version 5.1.1.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PocketSphinx is a small speech recognizer. Prior to 5.1.1, the trie language-model loaders in     src/lm/ngram_model_trie.c do not adequately validate boundary conditions in ARPA, DMP, and binary format     headers, and the acoustic-model loaders in src/mdef.c and src/util/bio.c use sscanf with unbounded string     fields. Loading an invalid, corrupted, or malicious language or acoustic model can therefore cause stack     or heap buffer overflows and memory corruption. An attacker who can write to a directory selected by     POCKETSPHINX_PATH can replace or add a model file that PocketSphinx later loads; users of PocketSphinx     5prealpha have no backported patch and must migrate to the fixed release. This issue is fixed in version     5.1.1. (CVE-2026-54559)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - PocketSphinx is a small speech recognizer. Prior to 5.1.1, the trie language-model loaders in
    src/lm/ngram_model_trie.c do not adequately validate boundary conditions in ARPA, DMP, and binary format
    headers, and the acoustic-model loaders in src/mdef.c and src/util/bio.c use sscanf with unbounded string
    fields. Loading an invalid, corrupted, or malicious language or acoustic model can therefore cause stack
    or heap buffer overflows and memory corruption. An attacker who can write to a directory selected by
    POCKETSPHINX_PATH can replace or add a model file that PocketSphinx later loads; users of PocketSphinx
    5prealpha have no backported patch and must migrate to the fixed release. This issue is fixed in version
    5.1.1. (CVE-2026-54559)

ID	Name	Product	Family	Type	Severity
346412	Linux Distros Unpatched Vulnerability : CVE-2026-54559	Nessus	Misc.	Local	medium
444848	SCA: security update for pocketsphinx (GHSA-56r5-2p2f-7cxp)	Tenable Cloud Security	SCA Checks	Local	medium
444848	SCA: security update for pocketsphinx (GHSA-56r5-2p2f-7cxp)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-54559

medium

Tenable Plugins

medium

medium

medium