CVE-2026-10298
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In whisper.cpp up to version 1.8.2, a vulnerability in the whisper_model_load function in ggml/src/ggml.c leads to null pointer dereference. Local access is required, and the exploit is publicly available. The project has not responded.
Risk Assessment
The organization is at risk of local attacks causing application crashes due to null pointer dereference, potentially leading to denial of service.
Recommendation
Upgrade whisper.cpp to a version above 1.8.2 or apply a temporary workaround if available.
Original NVD description (English source)
A security flaw has been discovered in ggml-org whisper.cpp up to 1.8.2. This vulnerability affects the function whisper_model_load of the file ggml/src/ggml.c. The manipulation results in null pointer dereference. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.