CVE-2026-17512
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A vulnerability in ggml-org whisper.cpp 1.8.4-58 in the function log_mel_spectrogram in file src/whisper.cpp. Manipulation leads to an out-of-bounds read. Local access is required. A pull request with a fix is pending acceptance.
Risk Assessment
Local attack could lead to disclosure of sensitive memory data or application crash.
Recommendation
Monitor the project repository for acceptance of the pull request. Temporarily restrict local access to the application.
Other vulnerabilities in whisper.cpp
See all- CVE-2026-17513Low
A vulnerability in ggml-org whisper.cpp (commit 95ea8f9b) in the function ggml_ftype_to_ggml_type in file ggml/src/ggml.c. Manipulation of the ftype argument leads to a reachable assertion. Local access is required. The project has not responded yet.
- CVE-2026-10298Low
In whisper.cpp up to version 1.8.2, a vulnerability in the whisper_model_load function in ggml/src/ggml.c leads to null pointer dereference. Local access is required, and the exploit is publicly available. The project has not responded.
Original NVD description (English source)
A vulnerability has been found in ggml-org whisper.cpp 1.8.4-58. This impacts the function log_mel_spectrogram of the file src/whisper.cpp. The manipulation leads to out-of-bounds read. The attack needs to be performed locally. The pull request to fix this issue awaits acceptance.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS