whisper.cpp EUVD-2026-101800

Requires the victim to load an attacker-supplied Whisper/GGML model file whose tensor-type field ('ttype') is outside the valid range (0 <= ttype < GGML_TYPE_COUNT), triggering the out-of-bounds read in whisper_model_load (src/whisper.cpp); the sibling parakeet_model_load and whisper_vad_init paths share the same flaw. Exploitation is strictly LOCAL (AV:L) and requires user interaction (UI:P) - the victim must choose to load the untrusted model; there is no remote or network-triggerable path. Limiting factors: attacker must get an untrusted model file onto the system and have it loaded, and impact is confined to availability (a crash) with no confidentiality or integrity effect, so this cannot be used for code execution or data theft based on the available data.

This is a low-severity, low-priority issue despite the 'Information Disclosure' tag. All signals point to minimal real-world risk: the provided CVSS 4.0 vector (AV:L/AC:L/PR:L/UI:P/VC:N/VI:N/VA:L) scores only 2.4, with a LOCAL attack vector, required user interaction, and impact limited to availability (VA:L) - notably no confidentiality impact (VC:N), which conflicts with the 'Information Disclosure' tag and the intuition that an out-of-bounds read leaks data. CWE-125 (OOB read) here most plausibly manifests as a crash rather than meaningful data exposure, consistent with VulDB's VC:N/VI:N rating. A public PROOF-OF-CONCEPT exists (E:P and the referenced GitHub issue #4090), and a vendor patch is available (v1.9.5, commit 60c0be6), but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation. The exploit requires an attacker to get a victim to load a maliciously crafted model file locally - not a remotely reachable service. Bottom line: a confirmed, publicly-exploitable but genuinely low-impact local bug; patch opportunistically rather than as an emergency. Note the minor signal conflict: the 'Information Disclosure'/'Buffer Overflow' tags overstate the impact relative to the authoritative CVSS (availability-only, no confidentiality).

An attacker crafts a malicious Whisper GGML model file containing an out-of-range 'ttype' tensor-type value and convinces a victim to load it (e.g., a model downloaded from an untrusted source). When whisper_model_load parses the file, the invalid ttype indexes a type-size lookup out of bounds, causing an out-of-bounds read that typically crashes the application. A public proof-of-concept is available via the vendor's GitHub issue tracker.