CVE-2026-17512

LowCVSS 3.3

Published: 27/07/2026(UTC)Updated: 27/07/2026(UTC)Translated: 27/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.11%

2th percentile - higher than 2% of all known CVEs

Summary

A vulnerability in ggml-org whisper.cpp 1.8.4-58 in the function log_mel_spectrogram in file src/whisper.cpp. Manipulation leads to an out-of-bounds read. Local access is required. A pull request with a fix is pending acceptance.

Risk Assessment

Local attack could lead to disclosure of sensitive memory data or application crash.

Recommendation

Monitor the project repository for acceptance of the pull request. Temporarily restrict local access to the application.

Original NVD description (English source)

A vulnerability has been found in ggml-org whisper.cpp 1.8.4-58. This impacts the function log_mel_spectrogram of the file src/whisper.cpp. The manipulation leads to out-of-bounds read. The attack needs to be performed locally. The pull request to fix this issue awaits acceptance.