CVE-2025-14569 MEDIUM

CVE-2025-14569: ggml-org whisper.cpp common-whisper.cpp read_audio_data use after free

Vendor Ggml-Org
Product whisper.cpp
Weakness CWE-416
Published December 12, 2025
Last update December 12, 2025

CVSS base score

4.8/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was detected in ggml-org whisper.cpp up to 1.8.2. Affected is the function read_audio_data of the file /whisper.cpp/examples/common-whisper.cpp. The manipulation results in use after free. The attack requires a local approach. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Key dates

02Disclosure timeline

December 12, 2025 CVE published
December 12, 2025 Record updated