CVE-2026-110810: fallo de gravedad baja en ggml-org whisper.cpp
ggml-org whisper.cpp Model Loader whisper_model_load out-of-bounds
Publicada el
28Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 2.4epss 0.1%
probabilidad de explotación
0.1%top 99% de las CVE
explotación observada
noninguna fuente lo reporta
1 exploit(s) público(s)
A vulnerability was detected in ggml-org whisper.cpp up to 1.9.4. This affects the function whisper_model_load of the file src/whisper.cpp of the component Model Loader. Performing a manipulation of the argument ttype results in out-of-bounds read. The attack must be initiated from a local position. The exploit is now public and may be used. Upgrading to version 1.9.5 is able to mitigate this issue. The patch is named 60c0be6ac8fa71b1a2ae2dd938a31a34a508e774. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Productos afectados
ggml-org · whisper.cppPoCs públicas encontradas — 1
cve_referencegithub.com/ggml-org/whisper.cpp/issues/4090no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — ggml-org whisper.cpp
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-17512MEDIUMggml-org whisper.cpp log_mel_spectrogram out-of-boundsEPSS 0.2%CVE-2026-17513MEDIUMggml-org whisper.cpp ggml.c ggml_ftype_to_ggml_type assertionEPSS 0.2%CVE-2025-14569MEDIUMggml-org whisper.cpp common-whisper.cpp read_audio_data use after freeEPSS 0.1%CVE-2026-10298MEDIUMggml-org whisper.cpp ggml.c whisper_model_load null pointer dereferenceEPSS 0.1%
Referencias
https://github.com/ggml-org/whisper.cpp/https://github.com/ggml-org/whisper.cpp/commit/60c0be6ac8fa71b1a2ae2dd938a31a34a508e774https://github.com/ggml-org/whisper.cpp/issues/4090https://github.com/ggml-org/whisper.cpp/pull/4091https://github.com/ggml-org/whisper.cpp/releases/tag/v1.9.5https://vuldb.com/cve/CVE-2026-110810https://vuldb.com/submit/1004714https://vuldb.com/vuln/420280https://vuldb.com/vuln/420280/cti