EUVD-2026-101708
GHSA-89mv-jhhr-rqh8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious whisper model file
-
DeliveryDeliver model to victim
-
ExploitVictim loads model in Praat
-
ExecutionOut-of-bounds write in whisper_model_load
-
ImpactMemory corruption / limited impact
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load an attacker-crafted whisper model file into Praat's Whisper-based speech recognition (the bundled external/whispercpp/whisper.cpp Model Loader); the malicious file sets the tensor n_dims argument outside the valid 0-4 range to trigger the out-of-bounds write. This is NOT remote-unauthenticated-against-default-config exploitation: the CVSS 4.0 vector's UI:P confirms required user interaction (the user must open/load the crafted model), which is the primary limiting factor. No authentication is required (PR:N), and impact is limited to LOW confidentiality/integrity/availability on the local system, with no scope change to other systems. |
| Impact | This is a genuinely low-priority issue despite being a memory-corruption (out-of-bounds write) bug. The CVSS 4.0 base score is only 2.1, and the vector (AV:N/AC:L/AT:N/PR:N/UI:P, impacts VC:L/VI:L/VA:L) shows why: exploitation requires user interaction (UI:P) and yields only LOW confidentiality, integrity, and availability impact with no subsequent-system impact (SC:N/SI:N/SA:N). The CVSS 4.0 string includes E:P, which aligns with the description's statement that 'the exploit has been disclosed publicly,' so public exploit/POC material exists - but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation. A key conflict: VulDB/NVD label the attack as initiatable 'remotely' (AV:N), yet the root cause is parsing of a malicious whisper model file in whisper_model_load, which realistically requires a victim to load an attacker-supplied model - this is better characterized as crafted-file processing with required user interaction than true remote exploitation. The vendor (Praat maintainer Paul Boersma) has confirmed and shipped a quick fix in 7.0.03 with a better fix scheduled. Overall: real but minor; treat as a routine patch, not an emergency. |
| Exploit ScenarioDerived | An attacker crafts a malicious whisper speech-recognition model file in which the n_dims field is set to an out-of-range value, then distributes it (e.g., via a shared model repository or social engineering) to a Praat user. When the victim loads the model, the whisper_model_load routine performs an out-of-bounds write during tensor dimension handling, potentially corrupting memory. Public exploit material has been disclosed, but the low CVSS impact (VC/VI/VA:L) and required user interaction limit practical severity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
An out-of-bounds write in the Whisper speech-recognition model loader bundled with Praat (external/whispercpp/whisper.cpp) is triggered when a user loads a crafted Whisper model whose tensor dimension count (n_dims) falls outside the expected 0-4 range, corrupting memory on the local system. Affected versions are Praat up to and including 7.0.02; exploitation requires user interaction - the victim must actively open the malicious model file - and no authentication is required, with impact limited to low confidentiality, integrity, and availability loss on the local host. Publicly available exploit code exists, but the issue is rated low priority given the local attack path and the required user action, and no data indicates confirmed active exploitation.
RemediationAI
Upgrade to Praat 7.0.03 or later: the maintainer confirms a quick fix (suggested fix 1, the n_dims 0-4 bounds check landing in commit a910d21a2705ef4cd16d91f29cdc8da1ab1a7221) was shipped in Praat version 7.0.03, and notes a better fix (suggested fix 2) is scheduled, so tracking later releases is advisable. If upgrading immediately is not possible, treat Whisper model files as untrusted input and avoid loading models from external, downloaded, or otherwise unverified sources into Praat's Whisper-based speech recognition - this removes the only known trigger, since exploitation requires the user to open the crafted model; the trade-off is that legitimate third-party models remain unusable in the affected build. There is no server-side control or network port to block for this issue because the attack path is local file loading, so restricting model provenance and user education are the practical compensating controls. Refer to the vendor issue at https://github.com/praat/praat.github.io/issues/3348 and the fix commit at https://github.com/PaulBoersma/praat/commit/a910d21a2705ef4cd16d91f29cdc8da1ab1a7221 for details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-119 improper-restriction-of-operations-within-the-bounds-of-a-memory-buffer defect that manifests as an out-of-bounds write. Praat ships a copy of whisper.cpp (the C/C++ Whisper speech-recognition implementation) under external/whispercpp/, and its static whisper_model_load() routine parses GGML-format model metadata, including each tensor's dimension count stored in the n_dims field. The loader trusted that value without validating it, so a model file declaring an out-of-range dimension count causes tensor-shape/offset calculations to index outside the intended buffers and write past their bounds. The upstream fix referenced for this CVE (commit a910d21a2705ef4cd16d91f29cdc8da1ab1a7221) inserts a guard rejecting any n_dims less than 0 or greater than 4 with an error log and a false return; the maintainer explicitly labels this a 'quick fix' for issue #3348 and notes a better fix is scheduled, the proper remedy being to update the vendored whisper.cpp. The attack surface is the model-loading path rather than a network service, which is why the authoritative assessment maps the vector to AV:L with UI:R.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Flaw triggers only when a user loads a crafted model file, so AV:L and UI:R; no auth needed (PR:N); out-of-bounds write yields limited C/I/A impact.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whisper_model_load of the file external/whispercpp/whisper.cpp of the component Model Loader. The manipulation of the argument n_dims leads to out-of-bounds write. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is a910d21a2705ef4cd16d91f29cdc8da1ab1a7221. To fix this issue, it is recommended to deploy a patch. The project maintainer confirms: "We did a quick fix (suggested fix 1) for Praat version 7.0.03, and scheduled a better fix (suggested fix 2)."
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB