CVE-2026-17512

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-17512", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-07-27T07:09:40.586Z", "datePublished": "2026-07-27T12:30:10.137Z", "dateUpdated": "2026-07-27T13:01:00.517Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-27T12:30:10.137Z"}, "title": "ggml-org whisper.cpp log_mel_spectrogram out-of-bounds", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-125", "lang": "en", "description": "Out-of-Bounds Read"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-119", "lang": "en", "description": "Memory Corruption"}]}], "affected": [{"vendor": "ggml-org", "product": "whisper.cpp", "versions": [{"version": "1.8.4-58", "status": "affected"}], "cpes": ["cpe:2.3:a:ggml-org:whisper.cpp:*:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in ggml-org whisper.cpp 1.8.4-58. This impacts the function log_mel_spectrogram of the file src/whisper.cpp. The manipulation leads to out-of-bounds read. The attack needs to be performed locally. The pull request to fix this issue awaits acceptance."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.3, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-07-27T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-07-27T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-07-27T09:14:52.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "m00dy (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/383382", "name": "VDB-383382 | ggml-org whisper.cpp log_mel_spectrogram out-of-bounds", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/383382/cti", "name": "VDB-383382 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-17512", "name": "CVE-2026-17512 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/798905", "name": "Submit #798905 | ggml-org whisper.cpp v1.8.4-58 Heap-based Buffer Overflow", "tags": ["third-party-advisory"]}, {"url": "https://github.com/ggml-org/whisper.cpp/issues/3923", "tags": ["issue-tracking"]}, {"url": "https://github.com/ggml-org/whisper.cpp/pull/3925", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/ggml-org/whisper.cpp/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202607"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-27T13:00:52.222702Z", "id": "CVE-2026-17512", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-27T13:01:00.517Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-17512", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-27T13:00:52.222702Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-27T13:00:57.367Z"}}], "cna": {"title": "ggml-org whisper.cpp log_mel_spectrogram out-of-bounds", "credits": [{"lang": "en", "type": "reporter", "value": "m00dy (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:ggml-org:whisper.cpp:*:*:*:*:*:*:*:*"], "vendor": "ggml-org", "product": "whisper.cpp", "versions": [{"status": "affected", "version": "1.8.4-58"}]}], "timeline": [{"lang": "en", "time": "2026-07-27T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-07-27T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-07-27T09:14:52.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/383382", "name": "VDB-383382 | ggml-org whisper.cpp log_mel_spectrogram out-of-bounds", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/383382/cti", "name": "VDB-383382 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-17512", "name": "CVE-2026-17512 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/798905", "name": "Submit #798905 | ggml-org whisper.cpp v1.8.4-58 Heap-based Buffer Overflow", "tags": ["third-party-advisory"]}, {"url": "https://github.com/ggml-org/whisper.cpp/issues/3923", "tags": ["issue-tracking"]}, {"url": "https://github.com/ggml-org/whisper.cpp/pull/3925", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/ggml-org/whisper.cpp/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202607"], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in ggml-org whisper.cpp 1.8.4-58. This impacts the function log_mel_spectrogram of the file src/whisper.cpp. The manipulation leads to out-of-bounds read. The attack needs to be performed locally. The pull request to fix this issue awaits acceptance."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "Out-of-Bounds Read"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "Memory Corruption"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-27T12:30:10.137Z"}}}, "cveMetadata": {"cveId": "CVE-2026-17512", "state": "PUBLISHED", "dateUpdated": "2026-07-27T13:01:00.517Z", "dateReserved": "2026-07-27T07:09:40.586Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-07-27T12:30:10.137Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ggml-org:whisper.cpp:*:*:*:*:*:*:*:*"], "product": "whisper.cpp", "vendor": "ggml-org", "versions": [{"status": "affected", "version": "1.8.4-58"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in ggml-org whisper.cpp 1.8.4-58. This impacts the function log_mel_spectrogram of the file src/whisper.cpp. The manipulation leads to out-of-bounds read. The attack needs to be performed locally. The pull request to fix this issue awaits acceptance."}, {"lang": "es", "value": "Una vulnerabilidad ha sido encontrada en ggml-org whisper.cpp 1.8.4-58. Esto afecta a la funci\u00f3n log_mel_spectrogram del archivo src/whisper.cpp. La manipulaci\u00f3n conduce a una lectura fuera de l\u00edmites. El ataque debe realizarse localmente. La solicitud de extracci\u00f3n para solucionar este problema espera ser aceptada."}], "id": "CVE-2026-17512", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 1.7, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.1, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-17512", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-27T13:00:52.222702Z", "version": "2.0.3"}}]}, "published": "2026-07-27T13:16:52.950", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/ggml-org/whisper.cpp/"}, {"source": "cna@vuldb.com", "url": "https://github.com/ggml-org/whisper.cpp/issues/3923"}, {"source": "cna@vuldb.com", "url": "https://github.com/ggml-org/whisper.cpp/pull/3925"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-17512"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/798905"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/383382"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/383382/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-125"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{"bugzilla": {"description": "whisper.cpp: whisper.cpp: Information disclosure via out-of-bounds read", "id": "2507460", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507460"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in whisper.cpp. A local attacker can exploit an out-of-bounds read vulnerability in the `log_mel_spectrogram` function. This flaw could lead to the disclosure of sensitive information."], "name": "CVE-2026-17512", "public_date": "2026-07-27T12:30:10Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-17512\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-17512\nhttps://github.com/ggml-org/whisper.cpp/\nhttps://github.com/ggml-org/whisper.cpp/issues/3923\nhttps://github.com/ggml-org/whisper.cpp/pull/3925\nhttps://vuldb.com/cve/CVE-2026-17512\nhttps://vuldb.com/submit/798905\nhttps://vuldb.com/vuln/383382\nhttps://vuldb.com/vuln/383382/cti"], "statement": "Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the affected packages, refer to the linked references.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.8.4-58"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "whisper.cpp", "vendor": "ggml-org"}], "created": "2026-07-27T13:30:04.024299+00:00", "updated": "2026-08-03T17:45:03.656087+00:00", "vendors": ["ggml-org", "ggml-org$PRODUCT$whisper.cpp"]}