CVE-2026-110698
mediumA security vulnerability has been detected in Praat up to 7.0.02.
A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whisper_model_load of the file external/whispercpp/whisper.cpp of the component Model Loader. The manipulation of the argument n_dims leads to out-of-bounds write. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is a910d21a2705ef4cd16d91f29cdc8da1ab1a7221. To fix this issue, it is recommended to deploy a patch. The project maintainer confirms: "We did a quick fix (suggested fix 1) for Praat version 7.0.03, and scheduled a better fix (suggested fix 2)."
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/PaulBoersma/praat/commit/a910d21a2705ef4cd16d91f29cdc8da1ab1a7221 cna@vuldb.com
- https://github.com/praat/praat.github.io/issues/3348 cna@vuldb.com
- https://vuldb.com/cve/CVE-2026-110698 cna@vuldb.com
- https://vuldb.com/submit/1004713 cna@vuldb.com
- https://vuldb.com/vuln/419892 cna@vuldb.com
- https://vuldb.com/vuln/419892/cti cna@vuldb.com