CVE-2026-10298: ggml-org whisper.cpp ggml.c whisper_model_load null pointer dereference
A security flaw has been discovered in ggml-org whisper.cpp up to 1.8.2. This vulnerability affects the function whispermodelload of the file ggml/src/ggml.c. The manipulation results in null pointer dereference. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10298?
The severity of CVE-2026-10298 is rated low with a score of 3.3.
How do I fix CVE-2026-10298?
To fix CVE-2026-10298, update ggml-org whisper.cpp to version 1.8.3 or later where the vulnerability has been addressed.
What type of vulnerability is CVE-2026-10298?
CVE-2026-10298 is a Null Pointer Dereference vulnerability.
Is local access required to exploit CVE-2026-10298?
Yes, exploiting CVE-2026-10298 requires local access to the affected system.
What component is affected by CVE-2026-10298?
The vulnerable component in CVE-2026-10298 is the function whisper_model_load in the file ggml/src/ggml.c.