CVE-2026-17512ggml-org whisper.cpp log_mel_spectrogram out-of-bounds

Description

A vulnerability has been found in ggml-org whisper.cpp 1.8.4-58. This impacts the function log_mel_spectrogram of the file src/whisper.cpp. The manipulation leads to out-of-bounds read. The attack needs to be performed locally. The pull request to fix this issue awaits acceptance.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• VDB-383382 | ggml-org whisper.cpp log_mel_spectrogram out-of-bounds vdb-entrytechnical-description
• VDB-383382 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
• CVE-2026-17512 | CVE Analysis and Report third-party-advisory
• Submit #798905 | ggml-org whisper.cpp v1.8.4-58 Heap-based Buffer Overflow third-party-advisory
• https://github.com/ggml-org/whisper.cpp/issues/3923 issue-tracking
• https://github.com/ggml-org/whisper.cpp/pull/3925 issue-trackingpatch
• https://github.com/ggml-org/whisper.cpp/ product