CVE-2026-110698

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-110698

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110698.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-110698

Published

2026-10-14T21:45:09Z

Modified

2026-10-15T10:50:00Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

Praat Model Loader whisper.cpp whisper_model_load out-of-bounds write

Details

A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whisper_model_load of the file external/whispercpp/whisper.cpp of the component Model Loader. The manipulation of the argument n_dims leads to out-of-bounds write. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is a910d21a2705ef4cd16d91f29cdc8da1ab1a7221. To fix this issue, it is recommended to deploy a patch. The project maintainer confirms: "We did a quick fix (suggested fix 1) for Praat version 7.0.03, and scheduled a better fix (suggested fix 2)."

Database specific

{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-119",
        "CWE-787"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110698.json"
}

References

Affected packages

Git / github.com/praat/praat.github.io

Affected ranges

Type

GIT

Repo

https://github.com/praat/praat.github.io

Events

Introduced

6f3da9ef1d8cce0d5684afc104d02888dfc71b25

Last Affected

6f3da9ef1d8cce0d5684afc104d02888dfc71b25

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "7.0.02"
        },
        {
            "last_affected":  "7.0.02"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

7.*

7.0.02

v7.*

v7.0.02

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110698.json"