PocketSphinx versions before 5.1.1 contain multiple memory safety issues due to inadequate validation of boundary conditions in trie language-model loaders (src/lm/ngram_model_trie.c) and unsafe use of sscanf with unbounded strings in acoustic-model loaders (src/mdef.c and src/util/bio.c). These flaws can cause stack or heap buffer overflows and memory corruption when loading invalid, corrupted, or malicious language or acoustic model files. Exploitation requires the attacker to write or replace model files in a directory controlled by the POCKETSPHINX_PATH environment variable. The issue is resolved in PocketSphinx 5.1.1.

Successful exploitation can lead to memory corruption through buffer overflows, potentially causing application crashes or arbitrary code execution. The vulnerability requires no privileges or user interaction but does require the attacker to have write access to the directory from which PocketSphinx loads model files. This could allow remote or local attackers to execute arbitrary code or cause denial of service.

This vulnerability is fixed in PocketSphinx version 5.1.1. Users should upgrade to version 5.1.1 or later to remediate this issue. There is no indication of any temporary or partial mitigations; therefore, upgrading is the recommended action.