CVE-2026-110810 in whisper.cpp
Summary
by MITRE • 10/15/2026
A vulnerability was detected in ggml-org whisper.cpp up to 1.9.4. This affects the function whisper_model_load of the file src/whisper.cpp of the component Model Loader. Performing a manipulation of the argument ttype results in out-of-bounds read. The attack must be initiated from a local position. The exploit is now public and may be used. Upgrading to version 1.9.5 is able to mitigate this issue. The patch is named 60c0be6ac8fa71b1a2ae2dd938a31a34a508e774. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified within ggml-org whisper.cpp versions up to 1.9.4 represents a critical memory safety issue located specifically within the Model Loader component. This flaw resides in the whisper_model_load function, which is responsible for parsing and initializing model weights during the startup phase of the application. The core technical defect involves an out-of-bounds read condition triggered by manipulating the ttype argument passed to this loading routine. In C++ applications dealing with binary data formats such as those used in machine learning models, precise boundary checking is essential when reading serialized structures from disk or memory buffers. When the ttype parameter assumes a value that does not align with expected model architecture specifications, the parser fails to validate array indices correctly before accessing memory locations associated with weight tensors. This lack of validation allows the application to read data beyond the allocated buffer boundaries, potentially exposing sensitive information stored in adjacent memory regions or causing undefined behavior depending on how the operating system handles such access violations.
From a classification perspective, this vulnerability aligns closely with CWE-125, which describes Out-of-bounds Read vulnerabilities where software reads past the end of an array or buffer. The exploitation vector is strictly local, meaning that an attacker must have some level of authenticated access to the target system to trigger the condition. This typically involves crafting a malicious model file with specific ttype values designed to exploit the parsing logic in whisper_model_load. Although the attack requires local initiation, the availability of public exploits significantly elevates the risk profile for systems where users are expected to load untrusted or third-party Whisper models. The presence of active exploitation code suggests that threat actors can reliably reproduce this condition without requiring complex chaining techniques, making it a high-priority target for automated scanning tools and targeted attacks against inference servers or local AI workstations.
The operational impact of this vulnerability extends beyond simple data leakage. Depending on the memory layout and compiler optimizations, an out-of-bounds read in a model loading context can lead to information disclosure where internal state variables, cryptographic keys, or other user data residing near the buffer are exposed. Furthermore, if the subsequent code relies on values derived from these corrupted reads, it may trigger logic errors that could be leveraged for further exploitation, although the primary classification remains an informational leak rather than remote code execution in this specific instance. The local nature of the attack limits its direct impact to compromised user accounts or systems with weak isolation boundaries, but given the increasing integration of AI models into automated pipelines and services, even local vulnerabilities can have broader implications if model loading is performed by privileged processes or within containerized environments that lack strict resource controls.
Mitigation strategies focus primarily on software updates provided by the vendor. The maintainers responded professionally to early disclosure and released version 1.9.5 which incorporates a patch identified as commit 60c0be6ac8fa71b1a2ae2dd938a31a34a508e774. This update likely introduces stricter validation checks for the ttype argument and ensures that all memory accesses during model loading are bounded by correctly calculated buffer limits. Organizations relying on whisper.cpp should immediately upgrade to version 1.9.5 or later to eliminate this risk. In environments where immediate patching is not feasible, defensive measures such as restricting file upload permissions for model files, implementing strict input validation at the application layer before passing arguments to the library, and utilizing memory protection mechanisms like Address Sanitizer during testing phases can help reduce exposure. Continuous monitoring of vendor advisories remains critical as AI libraries evolve rapidly and new attack surfaces are frequently discovered in complex parsing logic.