Null Pointer Dereference in ggml-org Whisper.cpp Affects Local Environments

CVE-2026-10298

What is CVE-2026-10298?

A security flaw has been identified in ggml-org's whisper.cpp, specifically in the function whisper_model_load found in the file ggml/src/ggml.c. This vulnerability leads to a null pointer dereference, which can be exploited by malicious actors if they have local access to the system. Although the project was notified early through an issue report, the issue remains unaddressed, making systems running affected versions susceptible to attack. As the exploit has been made public, immediate attention is recommended to mitigate potential security risks.

References