whisper.cpp CVE-2026-10298

Local, authenticated access with low privileges is required - the CVSS 4.0 vector confirms AV:L (local attack vector) and PR:L (low privileges required), meaning the attacker must already have a shell or equivalent access on the target host. Exploitation is triggered during model loading via the whisper_model_load function, implying the attacker must be able to supply or influence the model file or input data processed by that function. No network-based attack path exists. Exploitation is limited to causing the whisper.cpp application to crash (process-level denial of service); there is no path to arbitrary code execution, privilege escalation, or data access based on available vulnerability data. Non-default conditions that limit impact further: the attacker must be a local user, and the damage is confined to the availability of the whisper.cpp process, not the broader system.

The real-world risk of this vulnerability is very low. The CVSS 4.0 base score of 1.9 reflects an attack vector of Local (AV:L), low privileges required (PR:L), no user interaction (UI:N), and an impact confined to local availability at low severity (VA:L), with zero confidentiality or integrity impact. The E:P modifier in the CVSS 4.0 vector confirms a proof-of-concept is available, which marginally elevates practical risk by lowering the skill barrier for exploitation. However, the vulnerability is not listed in the CISA KEV catalog, and there is no indication of active or widespread exploitation. The local-only attack vector significantly constrains the threat surface: an attacker must already have authenticated, low-privilege shell access to the host running whisper.cpp. The sole consequence is crashing the whisper.cpp process, and there is no path to privilege escalation, data exfiltration, or lateral movement based on available data. This is a low-priority finding appropriate for remediation in a routine patch cycle, not emergency response.

A local user with standard (low-privilege) account access on a system running whisper.cpp crafts or supplies a malformed model file to the application. When whisper_model_load processes the file, the missing null check causes an immediate null pointer dereference, crashing the whisper.cpp process. A publicly available proof-of-concept demonstrating this crash exists in GitHub issue #3807, reducing the technical barrier for exploitation to near zero for anyone with local access.