CVE-2025-14569 - CVE House
Back to Database
Status published Medium CVE-2025-14569

ggml-org whisper.cpp common-whisper.cpp read_audio_data use after free

Vulnerability Description

A vulnerability was detected in ggml-org whisper.cpp up to 1.8.2. Affected is the function read_audio_data of the file /whisper.cpp/examples/common-whisper.cpp. The manipulation results in use after free. The attack requires a local approach. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-14569

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • repro
  • Oneafter (VulDB User)

References

More from ggml-org

View All →
CVE-2025-53630
Integer Overflow in GGUF Parser can lead to Heap Out-of-Bounds Read/Write in gguf
High 8.9
CVE-2025-52566
llama.cpp tokenizer signed vs. unsigned heap overflow
High 8.6
CVE-2025-49847
llama.cpp Vulnerable to Buffer Overflow via Malicious GGUF Model
High 8.8

Affected Vendor

Affected Software

whisper.cpp
Vulnerable Versions:
1.8.0, 1.8.1, 1.8.2

Timeline

Official Publish: December 12th, 2025
Last Modified: December 12th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Weaknesses (CWE)

CWE-416 CWE-119

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1055 Process Injection
Defense Evasion
T1105 Ingress Tool Transfer
Command and Control
T1485 Data Destruction
Impact
T1203 Exploitation for Client Execution
Execution