CVE-2026-54559
CVE-2026-54559 is a remote code execution vulnerability in pocketsphinx. O3 Security confirms whether CVE-2026-54559 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
PocketSphinx: Buffer overflows in language and acoustic model loading code
Real-World Exposure
pocketsphinxReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Impact
The trie language model code introduced in PocketSphinx 5prealpha failed to check various boundary conditions when reading the headers of ARPA, DMP, and binary format language model files. In the case of invalid, corrupted or malicious input files, this could lead to stack and heap buffer overflows.
In addition, the acoustic model loading code (which is over 30 years old...) contains numerous instances of sscanf with an unbounded string field which could also lead to stack overflows in the case of corrupt or malicious inputs.
Because PocketSphinx will search the directory given by the POCKETSPHINX_PATH environment variable for acoustic and language model files, if this directory is writable by untrusted users, an attacker could corrupt an existing file or write a malicious one to this directory in order to trigger the vulnerability.
Patches
The problem has been corrected in PocketSphinx 5.1.1.
There is no patch currently available for users of Pocketsphinx 5prealpha, who are encouraged to migrate as soon as possible to PocketSphinx 5.1.1.
Workarounds
Ensure that the POCKETSPHINX_PATH environment variable is either unset, or set to a directory whose contents are trusted and which cannot be written by untrusted users.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | pocketsphinx | all versions | 5.1.1 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for pocketsphinx. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update pocketsphinx to 5.1.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-54559 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether CVE-2026-54559 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to CVE-2026-54559. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-54559 in your dependencies?
O3 detects CVE-2026-54559 across PyPI dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.