The vulnerability resides in the save_audio_to_cache function of Gradio’s Audio Cache Key Handler in version 6.14.0, where a weak hash algorithm is used. An attacker who can execute code locally could manufacture cache keys that collide or predict the hash, potentially exposing or overriding cached audio data. The flaw is considered to have high complexity and difficult exploitability, but a public exploit has been released, indicating the attack is feasible in a controlled environment.

The Gradio open‑source library is affected, specifically version 6.14.0. The vendor provided patch 13394 addresses the weak hash and replaces it with a more robust algorithm.

The CVSS score is 2, signaling a low severity impact. EPSS data is unavailable and the flaw is not listed in the CISA KEV catalog, suggesting the likelihood of widespread exploitation is currently low. Nonetheless, the flaw requires local execution; therefore any user with privileged or local access to a system running this specific Gradio version could potentially exploit it, but the overall risk to business is moderate due to the local nature and high complexity.