Submit #1004714: ggml-org whisper.cpp commit 5670d5c0bbcb148feabef84400a07cfca9aa3b30 Out-of-bounds Read

A vulnerability was found in whisper.cpp commit 5670d5c0bbcb148feabef84400a07cfca9aa3b30
and classified as low 3.3. Affected is the whisper_model_load function of the legacy
ggml-*.bin model loader component. The manipulation of the argument ttype (the per-tensor
type field of a crafted model file) leads to an out-of-bounds read of the global
type_traits[] table in ggml_type_size (ggml/src/ggml.c:1336). User interaction is required
because a victim must run the whisper-cli tool (or another caller of
whisper_init_from_file_with_params) on an attacker-supplied model file.

Technical Details
- Affected file/function: src/whisper.cpp / whisper_model_load() -> ggml/src/ggml.c /
ggml_type_size()
- Vulnerable parameter: int32 ttype field of a tensor record in a legacy (GGML_FILE_MAGIC)
model file
- Attack vector: Local (user-run CLI on a downloaded model file)
- Privileges required: None
- Trigger condition: a tensor record whose ttype = GGML_TYPE_COUNT (43) passes every
existing loader validation (n_dims range, tensor-name lookup, element count, shape) and
is then used as an unchecked array index; the only guard is an assert() compiled out
under NDEBUG, which every release build defines. AddressSanitizer reports a
global-buffer-overflow READ of size 8 located 24 bytes after the 2408-byte global
'type_traits' (ggml/src/ggml.c:632). The malicious and benign sample files differ in
exactly one byte. Negative controls (untouched upstream fixture and the same record with
ttype=0) produce no sanitizer report.

Impact
- Confidentiality: None (the proven read is 24 bytes into adjacent read-only data and the
value is discarded by the next size check)
- Integrity: None (no write primitive on this path)
- Availability: Low (deterministic sanitizer abort of the CLI run as measured; the unbounded
int32 index plausibly reaches unmapped memory for large values, e.g. ttype=0x7FFFFFFF,
but that variant was not demonstrated)

CVSS v3.1
Score: 3.3 (Low)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Timeline
- Discovered: 2026-09-20
- Vendor notified: [pending]
- Patch released: [pending]
- Public disclosure: [pending]

Countermeasure
Range-check ttype in whisper_model_load before the ggml_type_size() call (mirroring the
existing n_dims check at src/whisper.cpp:1894) and replace the assert() in ggml_type_size
with GGML_ASSERT so the bound survives release builds.

• Quelle: ⚠️ https://github.com/ggml-org/whisper.cpp/issues/4090
• Benutzer: Dem00000 (UID 98563)
• Einreichung: 29.09.2026 05:43 (vor 16 Tagen)
• Moderieren: 14.10.2026 20:24 (16 days later)
• Status: Akzeptiert
• VulDB Eintrag: 420280 [ggml-org whisper.cpp bis 1.9.4 Model Loader src/whisper.cpp whisper_model_load ttype Information Disclosure]
• Punkte: 20