—score not recorded
Model tensor dimension count can exceed a four-element stack array
Fixed in: verified in v1.9.4; not asserted to be the first fixed version
fixed publicly
details
- Finding IDs
- F-WHISPER-001-002
- Status
- fixed publicly
- Fixed in
- verified in v1.9.4; not asserted to be the first fixed version
- Note
- Loading a crafted model file could provide an out-of-range tensor dimension count before values were read into ne[4]. The 7 August 2026 patch rejects n_dims below zero or above four before the dimension loop in both whisper_model_load and whisper_vad_init_with_params; the commit also hardens the Parakeet path. Both reported loader checks are present in stable v1.9.4. This requires loading an untrusted model, not merely transcribing an audio sample. The patch supports closure of the dimension-count stack-write path, not a demonstrated code-execution chain or closure of the distinct F-WHISPER-001-001 report. Public-source review does not establish vendor attribution, an assigned severity or a fresh end-to-end retest.
F-WHISPER-001-002: Memory safety. A model-controlled dimension count indexes beyond the fixed-size dimension array in the model loaders. Reviewed 26 Sep 2026. Mechanism assessed by 1seal.
Mechanism source for F-WHISPER-001-002
Security area (1seal assessment): Memory safety. A model-controlled dimension count indexes beyond the fixed-size dimension array in the model loaders. Reviewed 26 Sep 2026.