CVE-2025-14569
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A vulnerability was detected in ggml-org whisper.cpp up to 1.8.2. Affected is the function read_audio_data of the file /whisper.cpp/examples/common-whisper.cpp. The manipulation results in use after free. The attack requires a local approach. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Risk Assessment
A local attacker can exploit the use after free vulnerability to execute arbitrary code or cause application crash. The risk affects users of whisper.cpp up to version 1.8.2 who process untrusted audio files.
Recommendation
Monitor official whisper.cpp sources for an update fixing the vulnerability. Until a patch is released, avoid processing untrusted audio files with whisper.cpp.
Other vulnerabilities in whisper.cpp
See all- CVE-2026-17513Low
A vulnerability in ggml-org whisper.cpp (commit 95ea8f9b) in the function ggml_ftype_to_ggml_type in file ggml/src/ggml.c. Manipulation of the ftype argument leads to a reachable assertion. Local access is required. The project has not responded yet.
- CVE-2026-17512Low
A vulnerability in ggml-org whisper.cpp 1.8.4-58 in the function log_mel_spectrogram in file src/whisper.cpp. Manipulation leads to an out-of-bounds read. Local access is required. A pull request with a fix is pending acceptance.
- CVE-2026-10298Low
In whisper.cpp up to version 1.8.2, a vulnerability in the whisper_model_load function in ggml/src/ggml.c leads to null pointer dereference. Local access is required, and the exploit is publicly available. The project has not responded.
Original NVD description (English source)
A vulnerability was detected in ggml-org whisper.cpp up to 1.8.2. Affected is the function read_audio_data of the file /whisper.cpp/examples/common-whisper.cpp. The manipulation results in use after free. The attack requires a local approach. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS