Speaches CVE-2026-112145

Exploitation requires reaching the pyannote diarization model-loading path that calls PyannoteDiarizationModelManager._load_fn with an attacker-supplied 'model' argument; this code was introduced in PR #628 (switch to pyannote audio, commit 870e1e16a73452496e99d49f759eabd692a8e0e0), so only builds including that feature (up to 0.9.0-rc.3) are affected. Per CVSS (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is required and the attack is remote against a reachable speaches API. Practical limiting factors: the speaches server must be network-exposed, the diarization feature/endpoint must be reachable, and the deployment must run an affected pre-release version; speaches is a niche self-hosted tool, which bounds real-world exposure.

The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 5.5 (medium) and describes a remotely reachable, low-complexity, no-privilege, no-interaction flaw, but constrains impact to VC:L/VI:L/VA:L (only partial confidentiality, integrity and availability). The E:P in the vector is consistent with the confirmed public POC (poc.zip), so exploitation status is 'publicly available exploit code exists' - not active exploitation. This is NOT in CISA KEV, and no EPSS score or SSVC decision was provided, so widespread or automated exploitation cannot be asserted from the data. Net: a genuinely easy-to-trigger remote bug but with modest rated impact in a niche product, making it a moderate rather than top-tier priority. One caveat defenders should verify: CWE-470 (use of externally-controlled input to select classes or code, i.e. unsafe reflection) can in practice escalate to code execution, which would be far more severe than the VulDB-assigned VC:L/VI:L/VA:L - the low impact rating may understate real risk and should be confirmed against the POC. Risk is amplified for internet-exposed instances because the vendor was notified but has not responded and no patch exists.

An attacker who can reach the speaches HTTP API sends a diarization request in which the 'model' argument is manipulated; because PyannoteDiarizationModelManager._load_fn uses that externally-controlled value to select which class or code is loaded (CWE-470), the attacker influences what gets instantiated on the server. A public proof-of-concept (poc.zip) already exists, and the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the attack is remote, low-complexity and requires no authentication or user interaction, though the rated impact is limited to partial C/I/A.