Bug#1124796: whisper.cpp: CVE-2025-14569
Source: whisper.cpp
Version: 1.8.2+dfsg-3
Severity: important
Tags: security upstream
Forwarded: https://github.com/ggml-org/whisper.cpp/issues/3501
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Hi,
The following vulnerability was published for whisper.cpp.
CVE-2025-14569[0]:
| A vulnerability was detected in ggml-org whisper.cpp up to 1.8.2.
| Affected is the function read_audio_data of the file
| /whisper.cpp/examples/common-whisper.cpp. The manipulation results
| in use after free. The attack requires a local approach. The exploit
| is now public and may be used. The project was informed of the
| problem early through an issue report but has not responded yet.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2025-14569
https://www.cve.org/CVERecord?id=CVE-2025-14569
[1] https://github.com/ggml-org/whisper.cpp/issues/3501
Regards,
Salvatore
Reply to: