CVE-2026-17512 Overview
CVE-2026-17512 is an out-of-bounds read vulnerability in ggml-org whisper.cpp version 1.8.4-58. The flaw resides in the log_mel_spectrogram function within src/whisper.cpp. An attacker with local access and low privileges can manipulate input to trigger the out-of-bounds read. The issue is tracked under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). A pull request to remediate the issue is pending acceptance upstream.
Critical Impact
Local attackers can trigger an out-of-bounds read in the audio spectrogram processing path, potentially exposing adjacent memory contents or destabilizing the whisper.cpp process.
Affected Products
- ggml-org whisper.cpp version 1.8.4-58
- Applications and pipelines that embed the affected whisper.cpp library
- Downstream tools invoking the log_mel_spectrogram function on untrusted audio input
Discovery Timeline
- 2026-07-27 - CVE-2026-17512 published to the National Vulnerability Database (NVD)
- 2026-07-27 - Last updated in NVD database
Technical Details for CVE-2026-17512
Vulnerability Analysis
The vulnerability affects the log_mel_spectrogram function in src/whisper.cpp, which converts raw audio samples into a mel-spectrogram representation used for speech recognition. Improper bounds handling during this transformation allows a read past the end of an allocated buffer. Because the issue is classified as an out-of-bounds read, exploitation exposes memory adjacent to the target buffer rather than allowing writes. The consequences typically include information disclosure of process memory or a crash of the consuming application. Exploitation requires local access to the target system and low-level privileges to submit a crafted audio input to the affected function. No exploit is publicly available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Root Cause
The root cause is improper restriction of operations within the bounds of a memory buffer during mel-spectrogram computation. Missing or incorrect boundary checks on index calculations in log_mel_spectrogram allow the function to read beyond the intended buffer. Pull request #3925 and issue #3923 track the upstream fix.
Attack Vector
The attack vector is local. An attacker supplies a crafted audio input that is processed by an application linked against the vulnerable version of whisper.cpp. When log_mel_spectrogram operates on this input, the out-of-bounds read is triggered. No user interaction is required beyond invoking the affected code path. See the VulDB entry for CVE-2026-17512 for additional threat intelligence.
No verified proof-of-concept code is available. The vulnerability manifests inside the mel-spectrogram computation loop when index arithmetic exceeds the allocated frame buffer. Refer to GitHub Pull Request #3925 for the exact fix and the surrounding code context.
Detection Methods for CVE-2026-17512
Indicators of Compromise
- Unexpected crashes or aborts in processes linking whisper.cpp when handling audio inputs
- Application logs referencing errors originating from log_mel_spectrogram or src/whisper.cpp
- Presence of the affected whisper.cpp 1.8.4-58 binary or library in software inventory
Detection Strategies
- Inventory endpoints and build pipelines for whisper.cpp 1.8.4-58 using software composition analysis tools
- Instrument affected applications with AddressSanitizer (ASan) during testing to surface out-of-bounds reads in log_mel_spectrogram
- Monitor for anomalous process termination on hosts running speech-to-text workloads that embed whisper.cpp
Monitoring Recommendations
- Track newly introduced audio files or user-submitted media processed by hosts running whisper.cpp
- Alert on repeated crashes of processes that load the affected library
- Watch upstream references such as GitHub Issue #3923 for merge status of the fix
How to Mitigate CVE-2026-17512
Immediate Actions Required
- Identify all systems and container images that ship whisper.cpp 1.8.4-58 and prioritize them for patching
- Restrict local access to hosts running the vulnerable component to trusted, authenticated users only
- Constrain the audio inputs accepted by applications embedding whisper.cpp to trusted sources
Patch Information
An official patch is pending. The fix is proposed in GitHub Pull Request #3925 against the ggml-org whisper.cpp repository, and issue #3923 tracks the underlying defect. Rebuild affected applications once the pull request is merged and a fixed release is published on the ggml-org/whisper.cpp repository.
Workarounds
- Avoid processing untrusted or user-supplied audio files with whisper.cpp until an upstream release incorporates the fix
- Run whisper.cpp in a sandboxed or containerized environment with least-privilege execution to reduce impact of memory disclosure
- Apply the patch from Pull Request #3925 locally and rebuild the library if upstream acceptance is delayed
# Verify installed whisper.cpp version and locate affected binaries
grep -R "1.8.4-58" /path/to/whisper.cpp || echo "Version string not found"
find / -name "libwhisper*" -o -name "whisper-cli" 2>/dev/null
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
