CVE-2026-10298 Overview
CVE-2026-10298 is a null pointer dereference vulnerability in ggml-org whisper.cpp up to version 1.8.2. The flaw resides in the whisper_model_load function within ggml/src/ggml.c. An attacker with local access and low privileges can trigger the dereference, causing the affected process to crash. The exploit has been disclosed publicly. The maintainers were notified through an issue report but have not responded at the time of publication. The weakness is categorized under [CWE-404] (Improper Resource Shutdown or Release) and represents a denial of service condition rather than a code execution risk.
Critical Impact
Local attackers can crash applications that load Whisper models through whisper.cpp, disrupting availability of speech recognition workloads.
Affected Products
- ggml-org whisper.cpp versions up to and including 1.8.2
- Applications and services embedding the vulnerable whisper_model_load code path
- Downstream projects bundling ggml/src/ggml.c from affected releases
Discovery Timeline
- 2026-06-01 - CVE-2026-10298 published to NVD
- 2026-06-02 - Last updated in NVD database
Technical Details for CVE-2026-10298
Vulnerability Analysis
The vulnerability resides in the whisper_model_load function defined in ggml/src/ggml.c. When the function processes a model file, it fails to validate a pointer before dereferencing it. The resulting null pointer dereference terminates the host process. The EPSS score of 0.013% reflects the limited exploitability outside denial of service scenarios. Because exploitation requires local access and low privileges, the practical impact is bounded to availability loss on the affected host. There is no confidentiality or integrity impact according to the published CVSS vector.
Root Cause
The root cause is missing pointer validation inside whisper_model_load. The function dereferences a structure or buffer pointer that may be null when model loading fails or when crafted input bypasses earlier checks. This aligns with [CWE-404] improper resource handling, where allocation failures or malformed inputs lead to unchecked state and subsequent dereference.
Attack Vector
Exploitation requires local access to a system running an application linked against vulnerable whisper.cpp builds. The attacker supplies a crafted model file or triggers a load failure path that reaches the vulnerable dereference. No user interaction is required, but the attacker must have at least low privileges on the host. The outcome is a process crash and denial of service for the speech recognition workload.
No verified proof-of-concept code is available in vetted sources. Refer to the GitHub Issue #3807 and VulDB entry for CVE-2026-10298 for further technical context.
Detection Methods for CVE-2026-10298
Indicators of Compromise
- Unexpected crashes or segmentation faults in processes that link whisper.cpp or ggml
- Core dumps referencing whisper_model_load in the faulting stack frame
- Repeated failed loads of model files originating from untrusted local paths
Detection Strategies
- Monitor application logs for abnormal termination of services relying on whisper.cpp model loading
- Inspect endpoint telemetry for processes invoking whisper.cpp binaries with attacker-controlled model paths
- Correlate local file write events to model directories with subsequent crashes of speech recognition services
Monitoring Recommendations
- Enable kernel or userspace crash reporting to capture faulting addresses in ggml.c
- Track the version of whisper.cpp deployed across hosts to identify systems running 1.8.2 or earlier
- Alert on repeated process restarts of speech recognition components within short windows
How to Mitigate CVE-2026-10298
Immediate Actions Required
- Inventory all systems and applications that bundle whisper.cpp up to version 1.8.2
- Restrict local write access to directories containing Whisper model files
- Limit which local users can invoke binaries linked against the vulnerable library
Patch Information
No official patch is available at the time of publication. The project maintainers have not responded to the issue report referenced in GitHub Issue #3807. Track the ggml-org whisper.cpp repository for forthcoming fixes and rebuild dependent applications once a patched release is published.
Workarounds
- Validate model files against known-good checksums before invoking whisper_model_load
- Run speech recognition workloads under dedicated, low-privilege service accounts to reduce local attack surface
- Enable automatic process supervision so crashed services restart and preserve availability
- Consider applying a local source-level guard that checks pointer validity before the dereference if rebuilding from source
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
