CVE-2026-10298: whisper.cpp Null Pointer Dereference Vulnerability – Local Denial of Service

Technical summary

CVE-2026-10298 is a null pointer dereference flaw in the whisper_model_load function within ggml/src/ggml.c of ggml-org whisper.cpp up to version 1.8.2. The vulnerability stems from improper input validation during model file loading, allowing a local, low-privileged user to provide a specially crafted model file that causes the application to dereference a null pointer. This results in an unhandled exception and process termination. The flaw maps to CWE-404 (Improper Resource Validation) and CWE-476 (Null Pointer Dereference), indicating inadequate checks before pointer operations.

Business impact

The practical impact is limited but should not be ignored in environments where whisper.cpp processes untrusted model files. Affected deployments may experience service disruption if local users can supply malicious model files. For organizations running whisper.cpp as part of speech-to-text pipelines or inference services, this could trigger unplanned downtime. However, the vulnerability does not enable privilege escalation, data theft, or remote code execution. The risk is primarily operational availability on systems where model loading is exposed to local attackers or where user-supplied models are accepted without sandboxing.

Affected systems

The vulnerability affects ggml-org whisper.cpp versions up to and including 1.8.2. Any deployment running these versions on systems where local users can supply model files or trigger model loading is at potential risk. This includes development environments, local inference services, and internal speech processing pipelines that accept model inputs from multiple users or untrusted sources. Systems running versions newer than 1.8.2 are unaffected if patches have been applied; verify your deployed version against the whisper.cpp release notes.

Exploitability

Exploitation requires local system access and low-level user privileges. An attacker must be able to either place a malicious model file in a location where whisper.cpp loads it, or control the model file path supplied to the whisper_model_load function. The barrier to exploitation is intentionally high—remote exploitation is not feasible. Public exploit code now exists, removing the need for custom payload development, but the local-only attack vector constrains real-world risk. Organizations with strong filesystem access controls and input validation reduce their exposure substantially.

Remediation

Upgrade whisper.cpp to a version newer than 1.8.2. Consult the official ggml-org whisper.cpp repository and release notes for the latest stable build. Additionally, implement input validation on model file paths and implement filesystem permissions that restrict local user access to model directories. Where possible, run whisper.cpp in a sandboxed environment or container with minimal privileges to limit the blast radius of a crash.

Patch guidance

Check the ggml-org whisper.cpp GitHub repository for releases published after 1.8.2. Apply the latest available version through your build or package management system. Verify that model loading functions are exercised during testing to confirm the null pointer issue is resolved. If your deployment uses a frozen or pinned version of whisper.cpp, review whether your build includes any backported fixes or security patches from upstream before 1.8.2 was released.

Detection guidance

Monitor for repeated crashes or restarts of whisper.cpp processes on systems processing user-supplied model files. Inspect application logs and system error logs for null pointer dereference exceptions or segmentation faults originating from ggml/src/ggml.c. Audit filesystem access patterns to identify whether local users are able to write to directories where model files are stored. If feasible, enable core dumps or crash reporting to correlate failure timestamps with suspicious model file submissions. Implement alerting on unexpected process terminations in speech-processing pipelines.

Why prioritize this

While the CVSS score of 3.3 reflects the limited attack surface and low severity, this vulnerability should not be deprioritized entirely. The release of public exploit code elevates operational risk in environments where model loading is exposed to local attackers. Organizations should treat this as a medium-priority patch window item—not an emergency, but worth scheduling within the next 1-2 quarterly maintenance cycles. Teams managing speech-to-text or inference services internally should prioritize higher if local user model submissions are part of normal operations.

Risk score, explained

The CVSS 3.1 score of 3.3 (LOW severity) reflects a local-only attack vector, low privileges required, and no impact on data confidentiality or integrity. The sole impact is availability—an attacker can crash the process. The score does not account for the availability of public exploit code, which is noted separately. In contexts where whisper.cpp is used for mission-critical speech processing or operates in multi-tenant environments, the operational risk may feel higher than the numeric score suggests; adjust your organizational risk tolerance accordingly.

Frequently asked questions