This vulnerability in ggml-org whisper.cpp (up to version 1.8.2) occurs due to improper handling in the whisper_model_load function, leading to a null pointer dereference. The flaw can be triggered locally by an attacker with limited privileges, causing a denial of service or potential application crash. The CVSS 4.8 score reflects its medium severity, with low attack complexity and no user interaction required. No official patch or remediation guidance has been published by the vendor as of the latest information.

The vulnerability allows a local attacker to cause a null pointer dereference, likely resulting in denial of service or application crash. There is no indication of privilege escalation or remote exploitation. The presence of a public exploit increases the risk of local attacks, but the impact remains limited to local denial of service conditions.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's advisories for updates. Until a fix is released, restricting local access to trusted users and avoiding running vulnerable versions in untrusted environments is recommended. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.