CVE-2026-110698 Details
Description
A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whisper_model_load of the file external/whispercpp/whisper.cpp of the component Model Loader. The manipulation of the argument n_dims leads to out-of-bounds write. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is a910d21a2705ef4cd16d91f29cdc8da1ab1a7221. To fix this issue, it is recommended to deploy a patch. The project maintainer confirms: "We did a quick fix (suggested fix 1) for Praat version 7.0.03, and scheduled a better fix (suggested fix 2)."
A stack buffer overflow vulnerability has been identified in Praat versions through 7.0.02. The issue arises in the model loader function 'whisper_model_load', located in 'external/whispercpp/whisper.cpp'. The vulnerability is triggered by an unbounded read of the 'n_dims' argument, which is then used to write data into a fixed-size array on the stack. This flaw allows for out-of-bounds writes, creating a potential for memory corruption. The vulnerability can be exploited remotely by manipulating a 'community Whisper model' file, which Praat's user interface invites users to install. The issue has been publicly disclosed and exploited, with a patch available in Praat version 7.0.03.
Users can update to Praat version 7.0.03, which includes a quick fix for this vulnerability. However, a more comprehensive fix is scheduled for a future release.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/PaulBoersma/praat/commit/a910d21a2705ef4cd16d91f29cdc8da1ab1a7221 | [email protected] | Source CodeVendor |
| https://github.com/praat/praat.github.io/issues/3348 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-110698 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1004713 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/419892 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/419892/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | [email protected] |
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Praat | <= 7.0.02 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |