CVE-2026-17513
Received Received - Intake

Heap-based Assertion Failure in whisper.cpp

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: VulDB

Description
A vulnerability was found in ggml-org whisper.cpp 95ea8f9b. Affected is the function ggml_ftype_to_ggml_type of the file ggml/src/ggml.c. The manipulation of the argument ftype results in reachable assertion. The attack requires a local approach. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-17513
EUVD
EUVD-2026-49313

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ggml-org whisper.cpp 95ea8f9b
ggml-org whisper.cpp *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a reachable assertion in the whisper.cpp library where passing an invalid ftype value to the ggml_ftype_to_ggml_type function triggers a GGML_ASSERT that calls ggml_abort(). This causes the program to crash immediately, even in release builds, because the assertion is not disabled under -DNDEBUG. The issue occurs when ftype values like 5, 6, or values >=27 (after modulo 1000) are used.

Detection Guidance

This vulnerability can be detected by checking for crashes in whisper.cpp applications when loading models with invalid ftype values. Monitor logs for assertions or aborts in ggml_ftype_to_ggml_type or whisper_model_load functions. Test with models using ftype values like 5, 6, or >=27 (modulo 1000).

Commands to check: 1) Run whisper.cpp with a model using invalid ftype and observe crashes. 2) Use gdb to catch GGML_ASSERT failures. 3) Check system logs for abort messages from whisper.cpp processes.

Impact Analysis

This vulnerability could cause applications using whisper.cpp to crash unexpectedly when processing audio files with invalid ftype values. Since the crash bypasses normal error handling, it may lead to denial-of-service conditions for services relying on whisper.cpp for speech recognition tasks.

Compliance Impact

This vulnerability causes a crash due to a reachable assertion when invalid input is processed, which could lead to denial-of-service conditions. For compliance with standards like GDPR or HIPAA, such crashes may disrupt services handling sensitive data, potentially violating availability requirements. However, the vulnerability does not directly expose or leak data, so confidentiality or integrity breaches are not indicated.

Mitigation Strategies

Apply the suggested fix by modifying ggml_ftype_to_ggml_type to return a load error for unrecognized ftype values instead of asserting. Update to a patched version once available. Avoid using models with invalid ftype values until fixed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17513. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart