CVE-2026-110810

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-110810
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110810.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-110810
Published
2026-10-15T00:00:23Z
Modified
2026-10-16T02:47:40Z
Severity
  • 0.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
ggml-org whisper.cpp Model Loader whisper_model_load out-of-bounds
Details

A vulnerability was detected in ggml-org whisper.cpp up to 1.9.4. This affects the function whisper_model_load of the file src/whisper.cpp of the component Model Loader. Performing a manipulation of the argument ttype results in out-of-bounds read. The attack must be initiated from a local position. The exploit is now public and may be used. Upgrading to version 1.9.5 is able to mitigate this issue. The patch is named 60c0be6ac8fa71b1a2ae2dd938a31a34a508e774. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-119",
        "CWE-125"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110810.json"
}
References

Affected packages

Git / github.com/ggml-org/whisper.cpp

Affected ranges

Type
GIT
Repo
https://github.com/ggml-org/whisper.cpp
Events
Introduced
86c40c3bd6fc86f1187fb751d111b49e0fc18e84
Fixed
60c0be6ac8fa71b1a2ae2dd938a31a34a508e774
Fixed
d1be6fde11ac6e0407606b4e42fe72d34add8037
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "1.9.0"
        },
        {
            "last_affected":  "1.9.0"
        },
        {
            "introduced":  "1.9.1"
        },
        {
            "last_affected":  "1.9.1"
        },
        {
            "introduced":  "1.9.2"
        },
        {
            "last_affected":  "1.9.2"
        },
        {
            "introduced":  "1.9.3"
        },
        {
            "last_affected":  "1.9.3"
        },
        {
            "introduced":  "1.9.4"
        },
        {
            "last_affected":  "1.9.4"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
Other
b4938
b5127
b5130
v1.*
v1.9.0
v1.9.1
v1.9.2
v1.9.3
v1.9.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110810.json"