Threats affecting pkg:github/cmusphinx/pocketsphinx

CVE-2026-54559 affects PocketSphinx, a small speech recognizer, due to improper boundary validation in language-model loaders and unbounded string usage in acoustic-model loaders. This can lead to stack or heap buffer overflows and memory corruption when loading invalid or malicious model files. The vulnerability is fixed in version 5.1.1. Users of versions prior to 5.1.1 should upgrade to mitigate this issue.