UBUNTU-CVE-2026-54559

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-54559
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54559.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-54559
Upstream
Published
2026-09-14T20:16:00Z
Modified
2026-09-16T14:01:43Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

PocketSphinx is a small speech recognizer. Prior to 5.1.1, the trie language-model loaders in src/lm/ngram_model_trie.c do not adequately validate boundary conditions in ARPA, DMP, and binary format headers, and the acoustic-model loaders in src/mdef.c and src/util/bio.c use sscanf with unbounded string fields. Loading an invalid, corrupted, or malicious language or acoustic model can therefore cause stack or heap buffer overflows and memory corruption. An attacker who can write to a directory selected by POCKETSPHINX_PATH can replace or add a model file that PocketSphinx later loads; users of PocketSphinx 5prealpha have no backported patch and must migrate to the fixed release. This issue is fixed in version 5.1.1.

References

Affected packages

Ubuntu:16.04:LTS
pocketsphinx

Package

Name
pocketsphinx
Purl
pkg:deb/ubuntu/pocketsphinx?arch=source&distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.8.0+real-0ubuntu6
0.8.0+real5prealpha-1ubuntu2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "gstreamer1.0-pocketsphinx",
            "binary_version": "0.8.0+real5prealpha-1ubuntu2"
        },
        {
            "binary_name": "libpocketsphinx3",
            "binary_version": "0.8.0+real5prealpha-1ubuntu2"
        },
        {
            "binary_name": "pocketsphinx",
            "binary_version": "0.8.0+real5prealpha-1ubuntu2"
        },
        {
            "binary_name": "pocketsphinx-en-us",
            "binary_version": "0.8.0+real5prealpha-1ubuntu2"
        },
        {
            "binary_name": "python-pocketsphinx",
            "binary_version": "0.8.0+real5prealpha-1ubuntu2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54559.json"
Ubuntu:18.04:LTS
pocketsphinx

Package

Name
pocketsphinx
Purl
pkg:deb/ubuntu/pocketsphinx?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.8.0+real5prealpha-1ubuntu2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "gstreamer1.0-pocketsphinx",
            "binary_version": "0.8.0+real5prealpha-1ubuntu2"
        },
        {
            "binary_name": "libpocketsphinx3",
            "binary_version": "0.8.0+real5prealpha-1ubuntu2"
        },
        {
            "binary_name": "pocketsphinx",
            "binary_version": "0.8.0+real5prealpha-1ubuntu2"
        },
        {
            "binary_name": "pocketsphinx-en-us",
            "binary_version": "0.8.0+real5prealpha-1ubuntu2"
        },
        {
            "binary_name": "python-pocketsphinx",
            "binary_version": "0.8.0+real5prealpha-1ubuntu2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54559.json"
Ubuntu:20.04:LTS
pocketsphinx

Package

Name
pocketsphinx
Purl
pkg:deb/ubuntu/pocketsphinx?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.8.0+real5prealpha+1-6ubuntu1
0.8.0+real5prealpha+1-6ubuntu3
0.8.0+real5prealpha+1-6ubuntu4

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "gstreamer1.0-pocketsphinx",
            "binary_version": "0.8.0+real5prealpha+1-6ubuntu4"
        },
        {
            "binary_name": "libpocketsphinx3",
            "binary_version": "0.8.0+real5prealpha+1-6ubuntu4"
        },
        {
            "binary_name": "pocketsphinx",
            "binary_version": "0.8.0+real5prealpha+1-6ubuntu4"
        },
        {
            "binary_name": "pocketsphinx-en-us",
            "binary_version": "0.8.0+real5prealpha+1-6ubuntu4"
        },
        {
            "binary_name": "python3-pocketsphinx",
            "binary_version": "0.8.0+real5prealpha+1-6ubuntu4"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54559.json"
Ubuntu:22.04:LTS
pocketsphinx

Package

Name
pocketsphinx
Purl
pkg:deb/ubuntu/pocketsphinx?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.8.0+real5prealpha+1-13ubuntu1
0.8.0+real5prealpha+1-14ubuntu1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "gstreamer1.0-pocketsphinx",
            "binary_version": "0.8.0+real5prealpha+1-14ubuntu1"
        },
        {
            "binary_name": "libpocketsphinx3",
            "binary_version": "0.8.0+real5prealpha+1-14ubuntu1"
        },
        {
            "binary_name": "pocketsphinx",
            "binary_version": "0.8.0+real5prealpha+1-14ubuntu1"
        },
        {
            "binary_name": "pocketsphinx-en-us",
            "binary_version": "0.8.0+real5prealpha+1-14ubuntu1"
        },
        {
            "binary_name": "pocketsphinx-testdata",
            "binary_version": "0.8.0+real5prealpha+1-14ubuntu1"
        },
        {
            "binary_name": "swig-pocketsphinx",
            "binary_version": "0.8.0+real5prealpha+1-14ubuntu1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54559.json"
Ubuntu:24.04:LTS
pocketsphinx

Package

Name
pocketsphinx
Purl
pkg:deb/ubuntu/pocketsphinx?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.8.0+real5prealpha+1-15ubuntu1
0.8.0+real5prealpha+1-15ubuntu4
0.8.0+real5prealpha+1-15ubuntu5

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "gstreamer1.0-pocketsphinx",
            "binary_version": "0.8.0+real5prealpha+1-15ubuntu5"
        },
        {
            "binary_name": "libpocketsphinx3",
            "binary_version": "0.8.0+real5prealpha+1-15ubuntu5"
        },
        {
            "binary_name": "pocketsphinx",
            "binary_version": "0.8.0+real5prealpha+1-15ubuntu5"
        },
        {
            "binary_name": "pocketsphinx-en-us",
            "binary_version": "0.8.0+real5prealpha+1-15ubuntu5"
        },
        {
            "binary_name": "pocketsphinx-testdata",
            "binary_version": "0.8.0+real5prealpha+1-15ubuntu5"
        },
        {
            "binary_name": "swig-pocketsphinx",
            "binary_version": "0.8.0+real5prealpha+1-15ubuntu5"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54559.json"
Ubuntu:26.04:LTS
pocketsphinx

Package

Name
pocketsphinx
Purl
pkg:deb/ubuntu/pocketsphinx?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.8.0+real5prealpha+1-15ubuntu5
0.8.0+real5prealpha+1-15ubuntu6
5.*
5.0.4-3ubuntu1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "gstreamer1.0-pocketsphinx",
            "binary_version": "5.0.4-3ubuntu1"
        },
        {
            "binary_name": "libpocketsphinx5",
            "binary_version": "5.0.4-3ubuntu1"
        },
        {
            "binary_name": "pocketsphinx",
            "binary_version": "5.0.4-3ubuntu1"
        },
        {
            "binary_name": "pocketsphinx-en-us",
            "binary_version": "5.0.4-3ubuntu1"
        },
        {
            "binary_name": "pocketsphinx-testdata",
            "binary_version": "5.0.4-3ubuntu1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54559.json"