The flaw resides in the whisper_model_load function of ggml.cpp, where input handling fails to check for a null pointer. If an attacker can control the contents of a model file, the function will dereference a null pointer and cause the process to terminate. This error is classified as a null pointer dereference (CWE-476) and a missing resources error (CWE-404).

The vulnerability affects the ggml‑org Whisper.cpp project, specifically any release up to and including version 1.8.2. Users compiling and running Whisper.cpp in environments that load user‑supplied model files are exposed.

The official CVSS score is 4.8, indicating a medium impact and local attacker requirement. No EPSS data is available, and the vulnerability is not in the CISA KEV catalog. Because the attacker must be able to run code locally and the exploit code has already been released publicly, the primary risk is denial of service through application crash rather than remote compromise.