CVE-2026-110810 Details
Description
A vulnerability was detected in ggml-org whisper.cpp up to 1.9.4. This affects the function whisper_model_load of the file src/whisper.cpp of the component Model Loader. Performing a manipulation of the argument ttype results in out-of-bounds read. The attack must be initiated from a local position. The exploit is now public and may be used. Upgrading to version 1.9.5 is able to mitigate this issue. The patch is named 60c0be6ac8fa71b1a2ae2dd938a31a34a508e774. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
A vulnerability allowing for an out-of-bounds read has been identified in ggml-org Whisper.cpp versions prior to 1.9.4. The issue arises in the model loader function, where the tensor type argument is not properly validated, leading to a global buffer overflow. This vulnerability can be exploited locally and has been made public. The problem occurs when the 'ttype' field of a legacy model file is read without range checks, allowing an attacker to manipulate the input and access memory outside of the intended bounds.
Users are advised to upgrade to version 1.9.5, which includes a patch for this vulnerability. The updated version can be downloaded from the official Whisper.cpp GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ggml-org/whisper.cpp/ | [email protected] | Vendor |
| https://github.com/ggml-org/whisper.cpp/commit/60c0be6ac8fa71b1a2ae2dd938a31a34a508e774 | [email protected] | Source CodeVendor |
| https://github.com/ggml-org/whisper.cpp/issues/4090 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/ggml-org/whisper.cpp/pull/4091 | [email protected] | Issue TrackingVendor |
| https://github.com/ggml-org/whisper.cpp/releases/tag/v1.9.5 | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-110810 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1004714 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/420280 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/420280/cti | [email protected] | AdvisoryContent Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | [email protected] |
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ggml-org whisper.cpp | <= 1.9.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |