CVE-2026-17513

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-17513", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-07-27T07:09:45.327Z", "datePublished": "2026-07-27T12:45:10.017Z", "dateUpdated": "2026-07-27T16:20:39.097Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-27T12:45:10.017Z"}, "title": "ggml-org whisper.cpp ggml.c ggml_ftype_to_ggml_type assertion", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-617", "lang": "en", "description": "Reachable Assertion"}]}], "affected": [{"vendor": "ggml-org", "product": "whisper.cpp", "versions": [{"version": "95ea8f9b", "status": "affected"}], "cpes": ["cpe:2.3:a:ggml-org:whisper.cpp:*:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in ggml-org whisper.cpp 95ea8f9b. Affected is the function ggml_ftype_to_ggml_type of the file ggml/src/ggml.c. The manipulation of the argument ftype results in reachable assertion. The attack requires a local approach. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.3, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-07-27T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-07-27T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-07-27T09:14:56.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "m00dy (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/383383", "name": "VDB-383383 | ggml-org whisper.cpp ggml.c ggml_ftype_to_ggml_type assertion", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/383383/cti", "name": "VDB-383383 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-17513", "name": "CVE-2026-17513 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/799055", "name": "Submit #799055 | ggml-org whisper.cpp commit 95ea8f9b Reachable Assertion", "tags": ["third-party-advisory"]}, {"url": "https://github.com/ggml-org/whisper.cpp/issues/3924", "tags": ["issue-tracking"]}, {"url": "https://github.com/ggml-org/whisper.cpp/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202607"]}, "adp": [{"references": [{"url": "https://github.com/ggml-org/whisper.cpp/", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-27T16:20:29.539865Z", "id": "CVE-2026-17513", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-27T16:20:39.097Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-17513", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-27T16:20:29.539865Z"}}}], "references": [{"url": "https://github.com/ggml-org/whisper.cpp/", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-27T16:20:22.010Z"}}], "cna": {"title": "ggml-org whisper.cpp ggml.c ggml_ftype_to_ggml_type assertion", "credits": [{"lang": "en", "type": "reporter", "value": "m00dy (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:ggml-org:whisper.cpp:*:*:*:*:*:*:*:*"], "vendor": "ggml-org", "product": "whisper.cpp", "versions": [{"status": "affected", "version": "95ea8f9b"}]}], "timeline": [{"lang": "en", "time": "2026-07-27T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-07-27T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-07-27T09:14:56.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/383383", "name": "VDB-383383 | ggml-org whisper.cpp ggml.c ggml_ftype_to_ggml_type assertion", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/383383/cti", "name": "VDB-383383 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-17513", "name": "CVE-2026-17513 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/799055", "name": "Submit #799055 | ggml-org whisper.cpp commit 95ea8f9b Reachable Assertion", "tags": ["third-party-advisory"]}, {"url": "https://github.com/ggml-org/whisper.cpp/issues/3924", "tags": ["issue-tracking"]}, {"url": "https://github.com/ggml-org/whisper.cpp/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202607"], "descriptions": [{"lang": "en", "value": "A vulnerability was found in ggml-org whisper.cpp 95ea8f9b. Affected is the function ggml_ftype_to_ggml_type of the file ggml/src/ggml.c. The manipulation of the argument ftype results in reachable assertion. The attack requires a local approach. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-617", "description": "Reachable Assertion"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-27T12:45:10.017Z"}}}, "cveMetadata": {"cveId": "CVE-2026-17513", "state": "PUBLISHED", "dateUpdated": "2026-07-27T16:20:39.097Z", "dateReserved": "2026-07-27T07:09:45.327Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-07-27T12:45:10.017Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ggml-org:whisper.cpp:*:*:*:*:*:*:*:*"], "product": "whisper.cpp", "vendor": "ggml-org", "versions": [{"status": "affected", "version": "95ea8f9b"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in ggml-org whisper.cpp 95ea8f9b. Affected is the function ggml_ftype_to_ggml_type of the file ggml/src/ggml.c. The manipulation of the argument ftype results in reachable assertion. The attack requires a local approach. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en ggml-org whisper.cpp 95ea8f9b. La funci\u00f3n afectada es ggml_ftype_to_ggml_type del archivo ggml/src/ggml.c. La manipulaci\u00f3n del argumento ftype resulta en una aserci\u00f3n alcanzable. El ataque requiere un enfoque local. El proyecto fue informado del problema con antelaci\u00f3n a trav\u00e9s de un informe de incidencias, pero a\u00fan no ha respondido."}], "id": "CVE-2026-17513", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 1.7, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 3.1, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-17513", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-27T16:20:29.539865Z", "version": "2.0.3"}}]}, "published": "2026-07-27T14:16:52.073", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/ggml-org/whisper.cpp/"}, {"source": "cna@vuldb.com", "url": "https://github.com/ggml-org/whisper.cpp/issues/3924"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-17513"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/799055"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/383383"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/383383/cti"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/ggml-org/whisper.cpp/"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-617"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{"bugzilla": {"description": "whisper.cpp: whisper.cpp: Denial of Service via ftype argument manipulation", "id": "2507471", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507471"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-617", "details": ["A flaw was found in whisper.cpp, a library for machine learning. A local attacker can exploit a vulnerability in the ggml_ftype_to_ggml_type function by manipulating the ftype argument. This manipulation leads to a reachable assertion, which can cause the application to terminate, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-17513", "public_date": "2026-07-27T12:45:10Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-17513\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-17513\nhttps://github.com/ggml-org/whisper.cpp/\nhttps://github.com/ggml-org/whisper.cpp/issues/3924\nhttps://vuldb.com/cve/CVE-2026-17513\nhttps://vuldb.com/submit/799055\nhttps://vuldb.com/vuln/383383\nhttps://vuldb.com/vuln/383383/cti"], "statement": "Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the affected packages, refer to the linked references.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "95ea8f9b"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "whisper.cpp", "source": "cna", "vendor": "ggml-org"}, "product": "whisper.cpp", "vendor": "ggml-org"}], "created": "2026-07-27T15:30:17.375249+00:00", "title": "Local Denial of Service in Whisper.cpp via Assertion Failure", "updated": "2026-08-04T14:15:10.460356+00:00", "vendors": ["ggml-org", "ggml-org$PRODUCT$whisper.cpp"]}