Medium severity · published Dec 12, 2025
CVE-2025-14569
ggml-org whisper.cpp common-whisper.cpp read_audio_data use after free
5.3
CVSS
0.1%
EPSS
No
On KEV
Description
A vulnerability was detected in ggml-org whisper.cpp up to 1.8.2. Affected is the function read_audio_data of the file /whisper.cpp/examples/common-whisper.cpp. The manipulation results in use after free. The attack requires a local approach. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WH
whisper.cpp · ggml-org
1.8.0; 1.8.1; 1.8.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-14569
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-14569
github.com
https://github.com/ggml-org/whisper.cpp/issues/3501
github.com
https://github.com/oneafter/InvalidFree/blob/main/repro
vuldb.com
https://vuldb.com/?ctiid.336193
vuldb.com
https://vuldb.com/?id.336193
vuldb.com
https://vuldb.com/?submit.703886
More from whisper.cpp
3.3
CVE-2026-17513
ggml-org whisper.cpp ggml.c ggml_ftype_to_ggml_type assertion
3.3
CVE-2026-17512
ggml-org whisper.cpp log_mel_spectrogram out-of-bounds
3.3
CVE-2026-10298
ggml-org whisper.cpp ggml.c whisper_model_load null pointer dereference
2.8
CVE-2026-110810
ggml-org whisper.cpp Model Loader whisper_model_load out-of-bounds