CVE-2026-122159

Apply the remediation patch to the Audio8_TTS 0.1B INT8 ONNX runtime, then verify model loading and normal speech generation in staging. CVE-2026-122159 allows a crafted runtime_manifest.json to select a graph outside the chosen model package. The patch checks the selected slow, fast and codec paths before any ONNX session is created.

The upstream report describes graph substitution through a crafted or compromised model package. The candidate was tested against commit 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6.

This patch was created and tested by Casco. It has not been accepted or released by the upstream project.

Choose the patch and check applicability

Deployment	Action
Standalone 0.1B INT8 runtime at the tested commit	Review and apply the patch below, then run the path tests and your normal synthesis checks
A customized or different source revision	Check the diff against your code and repeat the regression and compatibility checks; clean application has only been verified at the pinned commit
0.6B runtime or optional registration loaders	Assess those loaders separately; this patch does not cover them
A deployment accepting third-party model packages	Restrict package intake to approved sources while reviewing and applying the path-containment change

Inventory every process that loads the 0.1B runtime, including CLI jobs and service workers. Record the source revision and the model-package location. Check whether manifests use slow_decode_models, fast_models, codec_models, or the legacy slow_decode_model and fast_model keys.

Before this work began on November 5, 2026, the current default branch was the affected commit, issue 41 was open, all 28 open and closed upstream PRs had been checked, and no GitHub release or existing manifest-containment patch was identified. That is a dated public-source assessment, not a claim about private vendor work or subsequent changes. Recheck upstream when selecting your deployment artifact.

Preserve the model-package boundary

A manifest filename must identify a regular file inside the selected package. The patch rejects empty or non-string values, null bytes, absolute or drive-qualified names, backslashes and parent-directory components. It resolves symlinks and rejects any resolved target outside the package.

All three selected paths are validated before the first graph session is constructed. Nested package-relative paths and symlinks to files inside the package remain supported. Repackage models that rely on absolute paths, backslash separators or external graph symlinks; do not bypass the check just to clear a loading error.

Keep the model package and its parent directories immutable to untrusted users while loading. Path validation does not authenticate a package, inspect ONNX external-data references or make a malicious in-package graph safe. Continue to use trusted model sources, independently distributed hashes or signatures, and an inference process with minimal filesystem access.

Apply the patch

1. Prepare recovery and staging. Preserve your current source revision, deployment configuration and trusted model package. Work in an isolated environment with harmless inputs and no production credentials. Record the source and model digests used for acceptance testing.
2. Review the exact artifact. Download the unified patch, regression tests and ONNX path-containment verification script. Verify the three SHA-256 checksums shown below. The change is confined to onnx_runtime_0_1b_int8/arktts_runtime/runtime.py.
3. Check applicability and apply. For the tested baseline, use the commands below. For a customized branch, reconcile the code first and repeat the tests; do not force a mismatched patch.
4. Run the regression checks. Place the downloaded test and witness files in the checkout root. Install the test dependencies in a separate environment and execute the commands below. The witness should report outsideGraphLoaded: false.
5. Stage normal operation, then roll out. Load approved model packages and exercise voice setup and ordinary speech generation through the interfaces you use. Restart every long-lived process after deploying the source change, and verify its effective revision before reopening package intake.

git clone https://github.com/Edge0-AI/Audio8_TTS.git
cd Audio8_TTS
git checkout 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6
git apply --check /path/to/audio8-manifest-containment.patch
git apply /path/to/audio8-manifest-containment.patch
python3 -m py_compile onnx_runtime_0_1b_int8/arktts_runtime/runtime.py

The test environment used these dependency versions:

python3 -m pip install numpy==2.5.4 onnx==1.23.2 onnxruntime==1.31.1 tokenizers==0.23.3
python3 test_manifest_paths.py candidate
python3 witness.py

SHA-256 checksums:

• audio8-manifest-containment.patch: 134f3dbfc4cbf2ca4ce70ff5c818470e0879d66a6884f79a77a9524f39343dcf
• test_manifest_paths.py: d860cf36509e7709e238ee7b140537840c54a943d60f22b2602ed25154e2f8ed
• witness.py: 2587a11650de4fa7e33f1e0def8e2735be86064fe59458eb5126ba302b69afaa.

Verify model loading and normal operation

Use controlled packages and harmless graphs in staging. The table gives acceptance criteria for your deployment; it is not a claim that Casco completed every deployment check.

Check	Expected result
Graph filenames are ordinary package-relative paths	Model sessions load from the selected package
A manifest selects a parent-directory, absolute or drive-qualified path	Loading is refused before any graph session is created
A selected file or directory symlink escapes the package	Loading is refused
An approved graph is nested inside the package, or linked from within it	Path containment permits it; normal model-contract checks still apply
A later fast or codec path is invalid	No earlier slow graph is loaded before the rejection
Approved voices, normal CLI jobs and deployed API requests	Expected speech output and service behavior remain intact after restart
Windows or a customized deployment is supported	Repeat the path and normal-operation checks on that actual environment

Casco executed the path regression suite and a real ONNX Runtime CPU witness. Full speech synthesis, voice functionality, web/API flows and Windows deployment were not tested. A passing path check does not establish that the model is authentic, its graph is safe, or speech generation is correct.

Containment and rollback

If deployment must wait, stop accepting untrusted model packages and restrict inference to approved, immutable packages. Review manifest paths and model provenance before use. Containment reduces exposure; it does not repair the affected constructor.

If a previously used package was unexpected or compromised, isolate it and investigate the model artifacts and service activity through your incident-response process. Applying this patch does not establish what an earlier graph did or reverse an earlier compromise.

Reverting the source patch restores the original path-selection behavior. Keep package intake contained during recovery. Prefer restoring an approved deployment together with its known-good configuration and model artifacts, then return to corrected code after resolving the compatibility issue.

Evidence and limits

The CVE Program record was published on November 5, 2026 at 02:15 UTC and identifies Audio8_TTS through commit 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6 as affected. Research and testing for this patch took place on November 5, 2026. The upstream report is by 3em0; the CNA credits Dem000000. The patch and validation package below record the tested source change.

Evidence	What it establishes
CNA record and upstream issue 41	Reported affected source, manifest-path behavior and disclosure context
Pinned source and exact diff	The code changed and the revision against which patch application was verified
Actual runtime regression suite	Original: 8 passed, 53 failed, 10 errors. Patched: 71 passed, 0 failed, 0 errors
Harmless ONNX CPU witness	The original constructor loaded an outside-package Identity graph and returned the test value 7; the patched constructor rejected the same manifest
Patch application and compilation checks	git apply --check, applied-byte comparison, git diff --check and Python compilation passed

The suite imports the actual upstream runtime and invokes its constructor. Most cases substitute session creation, model-contract checks, tokenizer and voice-store setup to isolate path selection. The independent witness uses real ONNX Runtime sessions while substituting only model-contract, tokenizer and voice setup; it does not synthesize speech. The original suite's failures and errors are regression outcomes, not 63 separate vulnerabilities.

No speech model weights, full synthesis, HTTP API, Windows or concurrent-filesystem tests were run. The 0.6B runtime, registration loaders and ONNX external-data references remain outside scope. Validation occurs before ONNX Runtime opens the file, so an attacker able to modify the package concurrently could create a filesystem race; keep the package and its parents immutable during loading.

The public patch, regression tests and CPU witness linked in this guide provide the reproducible validation artifacts. The original report, upstream PR inventory, release page and CVE record provide the source context.