CVE-2026-110810: falha de baixa gravidade em ggml-org whisper.cpp
ggml-org whisper.cpp Model Loader whisper_model_load out-of-bounds
Publicada em
28Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 2.4epss 0.1%
probabilidade de exploração
0.1%top 99% das CVEs
exploração observada
nãonenhuma fonte reporta
1 exploit(s) público(s)
A vulnerability was detected in ggml-org whisper.cpp up to 1.9.4. This affects the function whisper_model_load of the file src/whisper.cpp of the component Model Loader. Performing a manipulation of the argument ttype results in out-of-bounds read. The attack must be initiated from a local position. The exploit is now public and may be used. Upgrading to version 1.9.5 is able to mitigate this issue. The patch is named 60c0be6ac8fa71b1a2ae2dd938a31a34a508e774. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
ggml-org · whisper.cppPoCs públicas encontradas — 1
cve_referencegithub.com/ggml-org/whisper.cpp/issues/4090não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — ggml-org whisper.cpp
No mesmo produto, das mais perigosas para as menos.
CVE-2026-17512MEDIUMggml-org whisper.cpp log_mel_spectrogram out-of-boundsEPSS 0.2%CVE-2026-17513MEDIUMggml-org whisper.cpp ggml.c ggml_ftype_to_ggml_type assertionEPSS 0.2%CVE-2025-14569MEDIUMggml-org whisper.cpp common-whisper.cpp read_audio_data use after freeEPSS 0.1%CVE-2026-10298MEDIUMggml-org whisper.cpp ggml.c whisper_model_load null pointer dereferenceEPSS 0.1%
Referências
https://github.com/ggml-org/whisper.cpp/https://github.com/ggml-org/whisper.cpp/commit/60c0be6ac8fa71b1a2ae2dd938a31a34a508e774https://github.com/ggml-org/whisper.cpp/issues/4090https://github.com/ggml-org/whisper.cpp/pull/4091https://github.com/ggml-org/whisper.cpp/releases/tag/v1.9.5https://vuldb.com/cve/CVE-2026-110810https://vuldb.com/submit/1004714https://vuldb.com/vuln/420280https://vuldb.com/vuln/420280/cti