---
id: CVE-2026-110698
title: A security vulnerability has been detected in Praat up to 7.0.02
summary: >-
  A security vulnerability has been detected in Praat up to 7.0.02. Affected is
  the function whisper_model_load of the file external/whispercpp/whisper.cpp of
  the component Model Loader. The manipulation of the argument n_dims leads to
  out…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L'
cwe:
  - CWE-119
  - CWE-787
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T22:17:23.050'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-110698'
references:
  - url: >-
      https://github.com/PaulBoersma/praat/commit/a910d21a2705ef4cd16d91f29cdc8da1ab1a7221
    label: cna@vuldb.com
  - url: 'https://github.com/praat/praat.github.io/issues/3348'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/cve/CVE-2026-110698'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/1004713'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/419892'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/419892/cti'
    label: cna@vuldb.com
tags:
  - nvd
ingestedAt: '2026-10-14T23:00:02.041Z'
---

## Overview

A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whisper_model_load of the file external/whispercpp/whisper.cpp of the component Model Loader. The manipulation of the argument n_dims leads to out-of-bounds write. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is a910d21a2705ef4cd16d91f29cdc8da1ab1a7221. To fix this issue, it is recommended to deploy a patch. The project maintainer confirms: "We did a quick fix (suggested fix 1) for Praat version 7.0.03, and scheduled a better fix (suggested fix 2)."

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.