CVE-2026-17513 Overview
CVE-2026-17513 is a reachable assertion vulnerability [CWE-617] in the ggml_ftype_to_ggml_type function of ggml-org whisper.cpp build 95ea8f9b. The flaw resides in ggml/src/ggml.c, where manipulation of the ftype argument triggers an assertion failure. Exploitation requires local access and low privileges, and produces a denial-of-service condition against the whisper.cpp process. The project was notified through a public issue report but has not responded at the time of publication.
Critical Impact
A local attacker supplying a crafted ftype value can crash whisper.cpp through a reachable assertion, disrupting availability of inference workloads that depend on the library.
Affected Products
- ggml-org whisper.cpp commit 95ea8f9b
- Applications embedding the affected ggml.c from this build
- Downstream projects redistributing the unpatched ggml_ftype_to_ggml_type code path
Discovery Timeline
- 2026-07-27 - CVE-2026-17513 published to the National Vulnerability Database
- 2026-07-27 - Last updated in NVD database
Technical Details for CVE-2026-17513
Vulnerability Analysis
The vulnerability is a reachable assertion [CWE-617] in the ggml tensor library that underpins whisper.cpp. The ggml_ftype_to_ggml_type function maps a caller-provided file type enumerator (ftype) to an internal ggml tensor type. When the supplied value falls outside the expected set, an internal assertion fires and aborts the process. Because the assertion is reachable through normal API usage rather than gated by prior validation, malformed input propagates directly into the assert. The resulting crash terminates any transcription, inference, or model-loading task running in the affected process. The impact is limited to availability, with no memory corruption or code execution consequence documented in the advisory.
Root Cause
The root cause is missing input validation on the ftype argument before it reaches the assertion. The function relies on GGML_ASSERT (or equivalent) to enforce a precondition that should instead be handled by returning an error to the caller. Assertions used for input validation convert recoverable errors into fatal program termination.
Attack Vector
Exploitation requires local access with low privileges and no user interaction. An attacker who can influence the ftype value passed into whisper.cpp — for example, by supplying a crafted model file or invoking a wrapper that forwards untrusted parameters — can trigger the assertion. No network reachability is required, and confidentiality and integrity are not affected.
No verified public exploit code is available. See the GitHub Issue #3924 and VulDB CVE-2026-17513 entries for the original report.
Detection Methods for CVE-2026-17513
Indicators of Compromise
- Abrupt termination of whisper.cpp processes with an assertion failure message referencing ggml_ftype_to_ggml_type in ggml/src/ggml.c
- Core dumps or stderr entries containing GGML_ASSERT traces from the affected function
- Repeated crashes correlated with model-loading operations or unusual ftype values in application logs
Detection Strategies
- Monitor application logs and stderr for ggml assertion strings and abnormal exit codes from whisper.cpp workloads
- Track unexpected restarts of services that embed whisper.cpp, particularly those that accept externally supplied model files or parameters
- Review audit logs on multi-tenant hosts for local users invoking whisper.cpp binaries with unusual command-line arguments
Monitoring Recommendations
- Alert on process termination events (SIGABRT) originating from whisper.cpp or dependent binaries
- Instrument wrapper code to log ftype values received from callers before invoking ggml APIs
- Correlate crash telemetry with the local user identity to identify potential abuse patterns
How to Mitigate CVE-2026-17513
Immediate Actions Required
- Restrict local access to hosts running whisper.cpp to trusted users only
- Validate ftype and any other model parameters at the application layer before they reach ggml APIs
- Isolate whisper.cpp workloads in sandboxes or containers so an assertion abort does not affect adjacent services
Patch Information
No vendor patch has been published at the time of writing. The project maintainers had not responded to the GitHub Issue #3924 as of the NVD publication date. Track the whisper.cpp repository for a corrective commit that replaces the assertion with a proper error return path.
Workarounds
- Wrap calls into ggml_ftype_to_ggml_type with an allowlist of known-valid ftype values and reject anything else before invocation
- Rebuild whisper.cpp with a local patch that converts the offending GGML_ASSERT into a returned error code
- Run whisper.cpp under a process supervisor that restarts the service on abort, limiting availability impact from a triggered assertion
# Configuration example: constrain whisper.cpp under systemd with restart-on-abort
# /etc/systemd/system/whisper.service
[Service]
ExecStart=/usr/local/bin/whisper-server --model /srv/models/vetted.bin
Restart=on-abort
RestartSec=2
NoNewPrivileges=true
ProtectSystem=strict
PrivateTmp=true
User=whisper
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
