Whisper Cpp
Monthly
Local denial of service in ggml-org whisper.cpp 95ea8f9b via reachable assertion in ggml_ftype_to_ggml_type function. A local attacker with low privileges can cause a crash by supplying an invalid ftype argument. No public exploit identified; no patch available as vendor has not responded to issue report.
Local attackers with low privileges can trigger an out-of-bounds read in whisper.cpp 1.8.4-58 by supplying a very short audio sample to the log_mel_spectrogram function. This heap read overflow may leak sensitive information but does not allow code execution or system compromise. No public exploit or active exploitation has been reported.
Null pointer dereference in whisper.cpp up to version 1.8.2 allows a local authenticated attacker to crash the application via a crafted input during model loading. The vulnerable code path is the whisper_model_load function within ggml/src/ggml.c, resulting in a limited availability impact (application denial of service) with no confidentiality or integrity consequences. A proof-of-concept exploit is publicly available via a GitHub issue report; however, no vendor patch has been released and the project has not yet responded to the disclosure.
Local denial of service in ggml-org whisper.cpp 95ea8f9b via reachable assertion in ggml_ftype_to_ggml_type function. A local attacker with low privileges can cause a crash by supplying an invalid ftype argument. No public exploit identified; no patch available as vendor has not responded to issue report.
Local attackers with low privileges can trigger an out-of-bounds read in whisper.cpp 1.8.4-58 by supplying a very short audio sample to the log_mel_spectrogram function. This heap read overflow may leak sensitive information but does not allow code execution or system compromise. No public exploit or active exploitation has been reported.
Null pointer dereference in whisper.cpp up to version 1.8.2 allows a local authenticated attacker to crash the application via a crafted input during model loading. The vulnerable code path is the whisper_model_load function within ggml/src/ggml.c, resulting in a limited availability impact (application denial of service) with no confidentiality or integrity consequences. A proof-of-concept exploit is publicly available via a GitHub issue report; however, no vendor patch has been released and the project has not yet responded to the disclosure.