EUVD-2026-49189
GHSA-pw32-mv59-2r66
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocal access to system
-
DeliveryCraft short audio (<201 samples)
-
ExploitSubmit to whisper.cpp
-
Executionlog_mel_spectrogram triggered
-
PersistOOB read from heap
-
ImpactPotential information disclosure
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must have local access to a system running whisper.cpp and be able to submit audio samples to the audio processing chain. The attacking process requires low privileges (PR:L). The audio input must be shorter than 201 samples (specifically, fewer than stage_2_pad + 1 samples). No special configuration or non-default settings are required. Limiting factors: the vulnerability is local only, not remotely exploitable; it only leads to low confidentiality impact, not code execution or denial of service; and the attacker cannot control which heap data is read beyond the buffer (random OOB read). |
| Impact | The CVSS base score of 1.9 (AV:L/AC:L/PR:L/UI:N/VC:L/VI:N/VA:N) reflects a very low severity: local, low-privilege, no integrity or availability impact. The EPSS score was not provided, but given the low impact and local nature, exploitation probability is likely negligible. CISA KEV does not list this CVE. The SSVC decision would recommend 'Attend' or 'Track' rather than 'Act' due to the local attack vector, low technical impact, and no evidence of exploitation. The availability of a pull request fix (PR #3925) confirms the issue is real but not critical. Defenders should prioritize this only if local attackers are a realistic threat to their deployment. |
| Exploit ScenarioDerived | A local user with low privileges on a system running a whisper.cpp-based application could craft a specially short audio file (e.g., a 4-sample WAV) and submit it to the audio processing pipeline. When log_mel_spectrogram is called, the missing length check causes an out-of-bounds read beyond the heap buffer, potentially leaking adjacent memory contents. The attacker could then use the leaked data to gather sensitive information from the same process, such as model data or other audio samples. No proof-of-concept exploit code has been publicly shared, but the regression test in the PR demonstrates the vulnerability trigger. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
Local attackers with low privileges can trigger an out-of-bounds read in whisper.cpp 1.8.4-58 by supplying a very short audio sample to the log_mel_spectrogram function. This heap read overflow may leak sensitive information but does not allow code execution or system compromise. No public exploit or active exploitation has been reported.
RemediationAI
The primary fix is to apply the changes from pull request #3925 (https://github.com/ggml-org/whisper.cpp/pull/3925) pending its merge into the main branch. This adds a length check that rejects audio samples shorter than stage_2_pad + 1 (201 samples for standard FFT). Until a patched release is made, users can mitigate the issue by ensuring that any audio input to whisper.cpp has a minimum length of 201 samples; this can be enforced at the application level by padding short inputs with zeros or dropping them. The trade-off is that extremely short audio (e.g., sub-201-sample clips) will be rejected, which may affect applications that process bursts of very short audio segments. No other workaround for the root cause exists.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the log_mel_spectrogram function within src/whisper.cpp, which performs reflective padding on input audio samples before computing a mel spectrogram. The code reads samples[1..stage_2_pad] without checking that the input length (n_samples) meets the minimum requirement (stage_2_pad + 1, which equals WHISPER_N_FFT/2 + 1 = 201 samples for typical FFT sizes). This omission allows an out-of-bounds read (CWE-125) when processing audio shorter than 201 samples. The CPE cpe:2.3:a:ggml-org:whisper.cpp:*:*:*:*:*:*:*:* indicates all versions are potentially affected. The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction (UI:N), but only low confidentiality impact is possible (VC:L).
Know when Whisper Cpp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Local attack with low privileges, no user interaction, low confidentiality impact, no integrity or availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been found in ggml-org whisper.cpp 1.8.4-58. This impacts the function log_mel_spectrogram of the file src/whisper.cpp. The manipulation leads to out-of-bounds read. The attack needs to be performed locally. The pull request to fix this issue awaits acceptance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Whisper Cpp
View allNull pointer dereference in whisper.cpp up to version 1.8.2 allows a local authenticated attacker to crash the applicati
An out-of-bounds read in ggml-org whisper.cpp through version 1.9.4 lets a local attacker crash the application by getti
Local denial of service in ggml-org whisper.cpp 95ea8f9b via reachable assertion in ggml_ftype_to_ggml_type function. A
Exploit-DB