PT-2025-50961 · Ggml Org · Whisper.Cpp

Oneafter + 1 · Published 2025-12-12 · Updated 2025-12-13 · CVE-2025-14569

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions whisper.cpp versions up to 1.8.2

Description A flaw exists in ggml-org whisper.cpp, specifically within the read audio data function located in the /whisper.cpp/examples/common-whisper.cpp file. This issue leads to a use-after-free condition. Local access is required for exploitation. The details of the exploit are publicly available. The project maintainers were notified of the issue but have not yet responded.

Recommendations Versions prior to 1.8.2 should be updated. As a temporary workaround, consider restricting access to the /whisper.cpp/examples/common-whisper.cpp file to minimize the risk of exploitation.

Exploit

Fix

Use After Free

Buffer Overflow

Weakness Enumeration

CWE-416

CWE-119

Related Identifiers

CVE-2025-14569

Affected Products

Whisper.Cpp

References · 13

• 🔥 https://github.com/oneafter/InvalidFree/blob/main/repro · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-14569 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-14569 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-14569 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14569 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-14569 · Security Note
• https://ubuntu.com/security/CVE-2025-14569 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-14569 · Vendor Advisory
• https://github.com/ggml-org/whisper.cpp/issues/3501 · Note
• https://vuldb.com/?ctiid.336193 · Note
• https://twitter.com/CVEnew/status/1999876849191538841 · Twitter Post
• https://vuldb.com/?submit.703886 · Note
• https://vuldb.com/?id.336193 · Note