CVE-2026-122159

Audio8 TTS can load a speech model from outside its package

Edge0-AI · Audio8_TTS standalone 0.1B INT8 ONNX runtime

First documented disclosure · Review checkpoint

Summary

A crafted model manifest can make the speech runtime use a different local graph and change the generated output.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The researcher reproduced the graph substitution with a controlled comparison. The reviewed sources do not report malicious use.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The runtime joins graph filenames from the manifest to the model directory and checks file existence without restricting the resolved path.

Conditions required

A user loads an untrusted package and a compatible ONNX graph exists at a path accessible to the runtime.

Potential impact

The researcher demonstrated a change in generated codes using constant ONNX graphs. Host command execution or disclosure of arbitrary file contents was not shown.

Affected versions and configurations

The researcher tested 07e40f5d0b03. VulDB lists revisions through 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6.

Fix and mitigation status

No issue-specific fixed release was verified for the rolling project.

Practical next steps

Verify the complete graph manifest before loading a package and reject resolved paths outside its approved directory.

Operating lesson

Include externally resolved graphs when verifying the integrity of a model package.

Evidence and limits

The October 13 issue predates the November 5 CVE. A hostile package is an attack input. The report does not establish an unauthenticated internet API.

Sources