Out-of-bounds write in Praat whisper.cpp model loader
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Praat up to 7.0.02 is affected in its Model Loader component, specifically the whisper_model_load function of the bundled whisper.cpp code. A manipulated n_dims argument causes an out-of-bounds write, which corresponds to CWE-787. A remote attacker can trigger it without privileges, although user interaction is required. A public exploit has been disclosed and is linked in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whisper_model_load of the file external/whispercpp/whisper.cpp of the component Model Loader. The manipulation of the argument n_dims leads to out-of-bounds write. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is a910d21a2705ef4cd16d91f29cdc8da1ab1a7221. To fix this issue, it is recommended to deploy a patch. The project maintainer confirms: "We did a quick fix (suggested fix 1) for Praat version 7.0.03, and scheduled a better fix (suggested fix 2)."
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Praat | 7.0.02 | — | No fix listed | CNA |
- Praat Vendor— Affected 7.0.02 Fixed in — No fix listed CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:praat:praat:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:praat:praat:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
The project maintainer released a quick fix in Praat 7.0.03 and has scheduled a better fix. Apply patch commit a910d21 or upgrade to Praat 7.0.03.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-15 Threatist record created from CVE-2026-110698
- 2026-10-20 CISA SSVC decision points changed
- 2026-10-20 Priority changed: LOW → MEDIUM
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences