PT-2026-45661 · Ggml Org · Whisper.Cpp

M00Dy · Published 2026-06-01 · Updated 2026-06-01 · CVE-2026-10298

Mitre

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

A security flaw has been discovered in ggml-org whisper.cpp up to 1.8.2. This vulnerability affects the function whisper model load of the file ggml/src/ggml.c. The manipulation results in null pointer dereference. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Exploit

Fix

Improper Resource Release

NULL Pointer Dereference

Weakness Enumeration

CWE-404

CWE-476

Related Identifiers

CVE-2026-10298

Affected Products

Whisper.Cpp

References · 7

• 🔥 https://github.com/ggml-org/whisper.cpp/issues/3807 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-10298 · Security Note
• https://github.com/ggml-org/whisper.cpp · Note
• https://vuldb.com/submit/826910 · Note
• https://vuldb.com/cve/CVE-2026-10298 · Note
• https://vuldb.com/vuln/367591 · Note
• https://vuldb.com/vuln/367591/cti · Note