Skip to main content

Release Notes

Follow new updates and improvements to Speechmatics.

16.2.0 - Containers (Enhanced and Standard models)

Version 16.2.0 is now available for Batch Container, Realtime Container, GPU Transcription Inference Container and GPU Translation Inference Container.

Improvements

GPU & CPU

  • Improved accuracy for GPU Enhanced English when transcribing recent years (e.g. "2026").

  • Fix for English transcription with the Enhanced model: spoken numbers like "ten thousand" were sometimes incorrectly transcribed as "ten zero zero zero".

  • Improved accuracy and latency for Dutch with the Enhanced model when processing non-speech audio.

Fixes

Realtime

  • Fixed slight accuracy degradation with ForceEndOfUtterance for below languages, by reverting a previous latency optimisation, for: ba, be, bg, bn, ca, cmn, cmn_en, cs, cy, de, el, eo, et, eu, fa, gl, he, hi, hr, hu, ia, id, it, ko, lt, lv, mn, mr, ms, pl, pt, ro, sk, sl, sw, ta, th, tr, ug, uk, ur, vi, yue. ForceEndOfUtterance still works for all languages.

Security fixes

Vulnerability Management

  • Software Bill of Materials (SBOM) is available for download from the corresponding release page in our Support Portal.

  • OpenVEX statements are also available for each image, download from the corresponding release page in our Support Portal. These encode our assessment of CVEs that don't affect this release.

  • Triton Inference Server updated to 26.07, addressing the previously-tracked CVE-2026-47627 (Critical), CVE-2026-47628 and CVE-2026-47629 (High) against the GPU Transcription Inference and GPU Translation Inference images.

How to read these tables. Each row is keyed by the package a scanner attributes the advisory to. That attribution comes from the distribution's own security tracker rather than from the advisory's subject, so where an advisory concerns a component bundled by a different project, the tracker may attribute it to a package this image does ship even though the vulnerable component itself is not present. Scanner coverage also differs: not every row below is reported by every tool.

Patched, but still reported by scanners

The following vulnerabilities are fixed in the versions this release ships. Scanners that identify a package by the distribution's own records will continue to report them, because those records track the distribution's package version rather than the version installed here.

asr-usage-0.5.0

Component

Identified CVEs

Reason

libsqlcipher1

CVE-2019-8457, CVE-2020-27207

Fixed in the version this image ships.

batch-asr-transcriber-16.2.0

Component

Identified CVEs

Reason

ffmpeg

CVE-2023-6601, CVE-2023-6602, CVE-2023-6604, CVE-2023-6605, CVE-2023-49501, CVE-2023-49502, CVE-2023-49528, CVE-2023-50007, CVE-2023-50008, CVE-2024-7055, CVE-2024-31578, CVE-2024-31582, CVE-2024-32230, CVE-2024-35365, CVE-2024-35366, CVE-2024-35367, CVE-2024-35368, CVE-2024-36613, CVE-2024-36616, CVE-2024-36617, CVE-2024-36618, CVE-2024-36619, CVE-2025-0518, CVE-2025-1594, CVE-2025-7700, CVE-2025-9951, CVE-2025-10256, CVE-2025-12343, CVE-2025-22919, CVE-2025-22921, CVE-2025-25473, CVE-2025-59728, CVE-2025-59731, CVE-2025-59732, CVE-2025-59733, CVE-2025-59734, CVE-2025-63757, CVE-2026-30997, CVE-2026-30998, CVE-2026-30999, CVE-2026-40962, CVE-2026-64830, CVE-2026-64832, CVE-2026-64833, CVE-2026-64834, CVE-2026-64835, CVE-2026-65703, CVE-2026-65704, CVE-2026-65705, CVE-2026-65706, CVE-2026-66036, CVE-2026-66038, CVE-2026-66039, CVE-2026-70628, CVE-2026-70632, CVE-2026-75141, CVE-2026-75142, CVE-2026-75143, CVE-2026-75144, CVE-2026-75146

Fixed upstream in the version this image ships, which is ahead of the distribution’s package. Scanners report the distribution’s version.

gstreamer

CVE-2025-3887

Fixed in the Speechmatics build. The distribution has not released a fix, so scanners continue to report its own package version.

gstreamer

CVE-2025-6663, CVE-2026-1940, CVE-2026-2920, CVE-2026-2922, CVE-2026-2923, CVE-2026-3081, CVE-2026-3082, CVE-2026-3084, CVE-2026-3086, CVE-2026-12891, CVE-2026-12892, CVE-2026-19387, CVE-2026-19389, CVE-2026-52719, CVE-2026-52720, CVE-2026-52722, CVE-2026-53703, CVE-2026-53704, CVE-2026-73433

Fixed upstream in the version this image ships, which is ahead of the distribution’s package. Scanners report the distribution’s version.

Non-Applicable CVEs

The following vulnerabilities were reviewed and determined to have no security impact for this release.

asr-usage-0.5.0

Component

Identified CVEs

Reason

bsdutils

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

bytes

CVE-2026-25541

The affected code cannot be reached with externally supplied input.

diesel

GHSA-h5x4-m2qf-r4f2

The affected code cannot be reached with externally supplied input.

diesel

GHSA-wq9x-qwcq-mmgf

The affected code is not used at runtime.

gpgv

CVE-2025-68973

The affected code is not used at runtime.

gzip

CVE-2026-41992

The affected code is not used at runtime.

idna

CVE-2024-12224

The affected code is not used at runtime.

libblkid1

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

libcap2

CVE-2026-4878

The affected code is not used at runtime.

libgcrypt20

CVE-2024-2236, CVE-2026-41989

The affected code is not used at runtime.

libgnutls30t64

CVE-2024-12243, CVE-2025-6395, CVE-2025-9820, CVE-2025-14831, CVE-2025-32988, CVE-2025-32989, CVE-2025-32990, CVE-2026-3832, CVE-2026-3833, CVE-2026-5260, CVE-2026-5419, CVE-2026-33845, CVE-2026-33846, CVE-2026-42009, CVE-2026-42010, CVE-2026-42011, CVE-2026-42012, CVE-2026-42013, CVE-2026-42014, CVE-2026-42015

The affected code is not used at runtime.

libmount1

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

libncursesw6

CVE-2025-69720

The affected code is not used at runtime.

libp11-kit0

CVE-2026-13757, CVE-2026-18938

The affected code is not used at runtime.

libpcre2-8-0

CVE-2026-89157, CVE-2026-89161, CVE-2026-103111

The affected code is not used at runtime.

libsmartcols1

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

libssl-dev

CVE-2024-2511, CVE-2024-4603, CVE-2024-4741, CVE-2024-5535, CVE-2024-6119, CVE-2024-9143, CVE-2024-13176, CVE-2025-9230, CVE-2025-15467, CVE-2025-68160, CVE-2025-69418, CVE-2025-69419, CVE-2025-69420, CVE-2025-69421, CVE-2026-7383, CVE-2026-9076, CVE-2026-22795, CVE-2026-22796, CVE-2026-28387, CVE-2026-28388, CVE-2026-28389, CVE-2026-28390, CVE-2026-31789, CVE-2026-31790, CVE-2026-34180, CVE-2026-34182, CVE-2026-35189, CVE-2026-42766, CVE-2026-42767, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-54872, CVE-2026-54874, CVE-2026-63072, CVE-2026-63074, CVE-2026-63076, CVE-2026-75803, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84782

The affected code is not used at runtime.

libssl3t64

CVE-2024-2511, CVE-2024-4603, CVE-2024-4741, CVE-2024-5535, CVE-2024-6119, CVE-2024-9143, CVE-2024-13176, CVE-2025-9230, CVE-2025-15467, CVE-2025-68160, CVE-2025-69418, CVE-2025-69419, CVE-2025-69420, CVE-2025-69421, CVE-2026-7383, CVE-2026-9076, CVE-2026-22795, CVE-2026-22796, CVE-2026-28387, CVE-2026-28388, CVE-2026-28389, CVE-2026-28390, CVE-2026-31789, CVE-2026-31790, CVE-2026-34180, CVE-2026-34182, CVE-2026-35189, CVE-2026-42766, CVE-2026-42767, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447, CVE-2026-54872, CVE-2026-54874, CVE-2026-63072, CVE-2026-63074, CVE-2026-63076, CVE-2026-75803, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84782

The affected code is not used at runtime.

libtasn1-6

CVE-2024-12133, CVE-2025-13151

The affected code is not used at runtime.

libtinfo6

CVE-2025-69720

The affected code is not used at runtime.

libuuid1

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

mount

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

ncurses-base

CVE-2025-69720

The affected code is not used at runtime.

ncurses-bin

CVE-2025-69720

The affected code is not used at runtime.

openssl

GHSA-4fcv-w3qc-ppgg, GHSA-q445-7m23-qrmw, CVE-2025-24898, CVE-2026-41676, CVE-2026-41677, CVE-2026-41678, CVE-2026-41681, CVE-2026-41898, CVE-2026-42327, CVE-2026-44662, CVE-2026-45784

The affected code is not used at runtime.

perl-base

CVE-2026-8376, CVE-2026-9538, CVE-2026-13221, CVE-2026-42496, CVE-2026-42497, CVE-2026-57432, CVE-2026-82560

The affected code is not used at runtime.

ring

CVE-2025-4432

The affected code is not used at runtime.

util-linux

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

batch-asr-transcriber-16.2.0

Component

Identified CVEs

Reason

autobahn

CVE-2026-77528

The affected code is not used at runtime.

bsdutils

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

ffmpeg

CVE-2025-25467

The affected code is not used at runtime.

libblkid1

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

libde265-0

CVE-2026-88373

The affected code cannot be reached with externally supplied input.

libelf1t64

CVE-2025-1352

The affected code is not used at runtime.

libexpat1

CVE-2026-93990, CVE-2026-102633

The affected code is not used at runtime.

libfaad2

CVE-2019-5459

The affected code is not used at runtime.

libfdisk1

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

libfluidsynth3

CVE-2025-68617, CVE-2026-58264, CVE-2026-61714

The affected code is not used at runtime.

libmount1

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

libopenexr-3-1-30

CVE-2025-12495, CVE-2025-12839

The affected code is not present in the version shipped.

libopenexr-3-1-30

CVE-2023-5841, CVE-2024-31047, CVE-2026-27622, CVE-2026-34380, CVE-2026-34588, CVE-2026-41142, CVE-2026-42216, CVE-2026-42217

The affected code is not used at runtime.

libpcre2-8-0

CVE-2026-103111

The affected code cannot be reached with externally supplied input.

libpcre2-8-0

CVE-2026-89157, CVE-2026-89161

The affected code is not used at runtime.

libperl5.38t64

CVE-2026-82560

The affected code is not used at runtime.

libpipewire-0.3-0t64

CVE-2026-5674

The affected code is not used at runtime.

libpixman-1-0

CVE-2023-37769

The affected code cannot be reached with externally supplied input.

libpng16-16t64

CVE-2026-46675

The affected code is not used at runtime.

libpython3.12-minimal

CVE-2026-7210, CVE-2026-11940, CVE-2026-11972, CVE-2026-19445, CVE-2026-19553, CVE-2026-82049

The affected code is not used at runtime.

libpython3.12-minimal

CVE-2026-57178, CVE-2026-84366

The component the advisory covers is not present in this image.

libpython3.12-stdlib

CVE-2026-7210, CVE-2026-11940, CVE-2026-11972, CVE-2026-19445, CVE-2026-19553, CVE-2026-82049

The affected code is not used at runtime.

libpython3.12-stdlib

CVE-2026-57178, CVE-2026-84366

The component the advisory covers is not present in this image.

libslang2

CVE-2023-45927, CVE-2023-45929

The affected code is not used at runtime.

libsmartcols1

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

libsndfile1

CVE-2025-52194, CVE-2026-37555, CVE-2026-88372

The affected code is not used at runtime.

libsoup-3.0-0

CVE-2026-3632

Mitigated in the deployed configuration.

libsoup-3.0-0

CVE-2025-4035, CVE-2026-6324, CVE-2026-66338

The affected code cannot be reached with externally supplied input.

libsoup-3.0-0

CVE-2025-14523, CVE-2025-32049, CVE-2026-0716, CVE-2026-0719, CVE-2026-1761, CVE-2026-2369, CVE-2026-2436, CVE-2026-3099, CVE-2026-3633, CVE-2026-3634, CVE-2026-4271, CVE-2026-15709, CVE-2026-15711, CVE-2026-66337, CVE-2026-77014, CVE-2026-77680, CVE-2026-85197, CVE-2026-85534, CVE-2026-102555, CVE-2026-102556, CVE-2026-102557, CVE-2026-102558, CVE-2026-102559, CVE-2026-102560

The affected code is not used at runtime.

libsoup-3.0-common

CVE-2026-3632

Mitigated in the deployed configuration.

libsoup-3.0-common

CVE-2025-4035, CVE-2026-6324, CVE-2026-66338

The affected code cannot be reached with externally supplied input.

libsoup-3.0-common

CVE-2025-14523, CVE-2025-32049, CVE-2026-0716, CVE-2026-0719, CVE-2026-1761, CVE-2026-2369, CVE-2026-2436, CVE-2026-3099, CVE-2026-3633, CVE-2026-3634, CVE-2026-4271, CVE-2026-15709, CVE-2026-15711, CVE-2026-66337, CVE-2026-77014, CVE-2026-77680, CVE-2026-85197, CVE-2026-85534, CVE-2026-102555, CVE-2026-102556, CVE-2026-102557, CVE-2026-102558, CVE-2026-102559, CVE-2026-102560

The affected code is not used at runtime.

libspa-0.2-modules

CVE-2026-5674

The affected code is not used at runtime.

libssl3t64

CVE-2026-35189, CVE-2026-54872, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84782

The affected code is not used at runtime.

libtag1v5

CVE-2023-47466

The affected code is not used at runtime.

libtag1v5-vanilla

CVE-2023-47466

The affected code is not used at runtime.

libtesseract5

CVE-2026-73066, CVE-2026-73067, CVE-2026-88047, CVE-2026-88048, CVE-2026-88049, CVE-2026-88050, CVE-2026-88051, CVE-2026-88052, CVE-2026-88053, CVE-2026-88054

The affected code is not used at runtime.

libtiff6

CVE-2026-4775, CVE-2026-12912

The affected code is not used at runtime.

libuuid1

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

libvo-amrwbenc0

CVE-2019-2128

The affected code is not used at runtime.

libx11-6

CVE-2026-88806

The affected code is not used at runtime.

libx11-data

CVE-2026-88806

The affected code is not used at runtime.

libx11-xcb1

CVE-2026-88806

The affected code is not used at runtime.

libx264-164

CVE-2025-25467

The affected code is not used at runtime.

libxi6

CVE-2026-93543

The affected code is not used at runtime.

libxml2

CVE-2026-86139, CVE-2026-86142, CVE-2026-86144

The affected code is not used at runtime.

libxtst6

CVE-2026-94286

The affected code is not used at runtime.

libzvbi-common

CVE-2025-2173, CVE-2025-2174, CVE-2025-2175, CVE-2025-2176, CVE-2025-2177

The affected code is not used at runtime.

libzvbi0t64

CVE-2025-2173, CVE-2025-2174, CVE-2025-2175, CVE-2025-2176, CVE-2025-2177

The affected code is not used at runtime.

mount

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

openssl

CVE-2026-35189, CVE-2026-54872, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84782

The affected code is not used at runtime.

perl

CVE-2026-82560

The affected code is not used at runtime.

perl-base

CVE-2026-82560

The affected code is not used at runtime.

perl-modules-5.38

CVE-2026-82560

The affected code is not used at runtime.

pyjwt

CVE-2026-101917, CVE-2026-101918, CVE-2026-102265, CVE-2026-102266, CVE-2026-102267, CVE-2026-102268, CVE-2026-102269, CVE-2026-102270, CVE-2026-102271, CVE-2026-102272, CVE-2026-102273, CVE-2026-102274, CVE-2026-102275, CVE-2026-103001

The affected code is not used at runtime.

python3-pip

CVE-2025-66418, CVE-2025-66471, CVE-2026-8643, CVE-2026-21441, CVE-2026-44431, CVE-2026-44432

The affected code is not used at runtime.

python3.12

CVE-2026-7210, CVE-2026-11940, CVE-2026-11972, CVE-2026-19445, CVE-2026-19553, CVE-2026-82049

The affected code is not used at runtime.

python3.12

CVE-2026-57178, CVE-2026-84366

The component the advisory covers is not present in this image.

python3.12-minimal

CVE-2026-7210, CVE-2026-11940, CVE-2026-11972, CVE-2026-19445, CVE-2026-19553, CVE-2026-82049

The affected code is not used at runtime.

python3.12-minimal

CVE-2026-57178, CVE-2026-84366

The component the advisory covers is not present in this image.

util-linux

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

sm-gpu-inference-server-16.2.0

Component

Identified CVEs

Reason

binutils

CVE-2025-66862, CVE-2025-66863, CVE-2025-66864, CVE-2025-66865, CVE-2025-66866, CVE-2026-3441, CVE-2026-3442, CVE-2026-6846

The affected code cannot be reached with externally supplied input.

binutils-common

CVE-2025-66862, CVE-2025-66863, CVE-2025-66864, CVE-2025-66865, CVE-2025-66866, CVE-2026-3441, CVE-2026-3442, CVE-2026-6846

The affected code cannot be reached with externally supplied input.

binutils-x86-64-linux-gnu

CVE-2025-66862, CVE-2025-66863, CVE-2025-66864, CVE-2025-66865, CVE-2025-66866, CVE-2026-3441, CVE-2026-3442, CVE-2026-6846

The affected code cannot be reached with externally supplied input.

bsdutils

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

cpp

CVE-2026-95619, CVE-2026-102010

The affected code cannot be reached with externally supplied input.

cpp-13

CVE-2026-95619, CVE-2026-102010

The affected code cannot be reached with externally supplied input.

cpp-13-x86-64-linux-gnu

CVE-2026-95619, CVE-2026-102010

The affected code cannot be reached with externally supplied input.

cpp-x86-64-linux-gnu

CVE-2026-95619, CVE-2026-102010

The affected code cannot be reached with externally supplied input.

cuda-compat-13-0

CVE-2026-47489, CVE-2026-47491, CVE-2026-47494, CVE-2026-47496, CVE-2026-47500, CVE-2026-47501, CVE-2026-47503, CVE-2026-47504, CVE-2026-47507, CVE-2026-47508, CVE-2026-47510, CVE-2026-47511, CVE-2026-47512, CVE-2026-47513, CVE-2026-47514, CVE-2026-47516, CVE-2026-47523, CVE-2026-47528, CVE-2026-47530, CVE-2026-47540, CVE-2026-47545, CVE-2026-47548, CVE-2026-47551, CVE-2026-47552, CVE-2026-47553, CVE-2026-47554, CVE-2026-47556, CVE-2026-47558, CVE-2026-47559, CVE-2026-47560, CVE-2026-47561, CVE-2026-47563, CVE-2026-47569, CVE-2026-47573, CVE-2026-47587, CVE-2026-47588, CVE-2026-47589, CVE-2026-47590, CVE-2026-47591, CVE-2026-47592, CVE-2026-47594, CVE-2026-47595, CVE-2026-47596, CVE-2026-47597, CVE-2026-47598, CVE-2026-47599, CVE-2026-47600, CVE-2026-47601, CVE-2026-47602

The affected code is not present in the version shipped.

gcc

CVE-2026-95619, CVE-2026-102010

The affected code cannot be reached with externally supplied input.

gcc-13

CVE-2026-95619, CVE-2026-102010

The affected code cannot be reached with externally supplied input.

gcc-13-base

CVE-2026-95619, CVE-2026-102010

The affected code cannot be reached with externally supplied input.

gcc-13-x86-64-linux-gnu

CVE-2026-95619, CVE-2026-102010

The affected code cannot be reached with externally supplied input.

gcc-x86-64-linux-gnu

CVE-2026-95619, CVE-2026-102010

The affected code cannot be reached with externally supplied input.

libbinutils

CVE-2025-66862, CVE-2025-66863, CVE-2025-66864, CVE-2025-66865, CVE-2025-66866, CVE-2026-3441, CVE-2026-3442, CVE-2026-6846

The affected code cannot be reached with externally supplied input.

libblkid1

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

libctf-nobfd0

CVE-2025-66862, CVE-2025-66863, CVE-2025-66864, CVE-2025-66865, CVE-2025-66866, CVE-2026-3441, CVE-2026-3442, CVE-2026-6846

The affected code cannot be reached with externally supplied input.

libctf0

CVE-2025-66862, CVE-2025-66863, CVE-2025-66864, CVE-2025-66865, CVE-2025-66866, CVE-2026-3441, CVE-2026-3442, CVE-2026-6846

The affected code cannot be reached with externally supplied input.

libexpat1

CVE-2026-93990, CVE-2026-102633

The affected code cannot be reached with externally supplied input.

libfdisk1

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

libfreetype6

CVE-2026-95512

The affected code is not used at runtime.

libgcc-13-dev

CVE-2026-95619, CVE-2026-102010

The affected code cannot be reached with externally supplied input.

libgprofng0

CVE-2025-66862, CVE-2025-66863, CVE-2025-66864, CVE-2025-66865, CVE-2025-66866, CVE-2026-3441, CVE-2026-3442, CVE-2026-6846

The affected code cannot be reached with externally supplied input.

libheif-plugin-aomdec

CVE-2026-84384, CVE-2026-84447, CVE-2026-84448, CVE-2026-84449

The affected code is not used at runtime.

libheif-plugin-aomenc

CVE-2026-84384, CVE-2026-84447, CVE-2026-84448, CVE-2026-84449

The affected code is not used at runtime.

libheif1

CVE-2026-84384, CVE-2026-84447, CVE-2026-84448, CVE-2026-84449

The affected code is not used at runtime.

libmount1

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

libpcre2-8-0

CVE-2026-89157, CVE-2026-89161, CVE-2026-103111

The affected code is not used at runtime.

libperl5.38t64

CVE-2026-82560

The affected code is not used at runtime.

libpython3.12-minimal

CVE-2026-57178, CVE-2026-84366

The affected code is not present in the version shipped.

libpython3.12-minimal

CVE-2026-7210, CVE-2026-11940, CVE-2026-11972, CVE-2026-19445, CVE-2026-19553, CVE-2026-82049

The affected code is not used at runtime.

libpython3.12-stdlib

CVE-2026-57178, CVE-2026-84366

The affected code is not present in the version shipped.

libpython3.12-stdlib

CVE-2026-7210, CVE-2026-11940, CVE-2026-11972, CVE-2026-19445, CVE-2026-19553, CVE-2026-82049

The affected code is not used at runtime.

libpython3.12t64

CVE-2026-57178, CVE-2026-84366

The affected code is not present in the version shipped.

libpython3.12t64

CVE-2026-7210, CVE-2026-11940, CVE-2026-11972, CVE-2026-19445, CVE-2026-19553, CVE-2026-82049

The affected code is not used at runtime.

libsframe1

CVE-2025-66862, CVE-2025-66863, CVE-2025-66864, CVE-2025-66865, CVE-2025-66866, CVE-2026-3441, CVE-2026-3442, CVE-2026-6846

The affected code cannot be reached with externally supplied input.

libsmartcols1

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

libssl3t64

CVE-2026-35189, CVE-2026-54872, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84782

The affected code is not used at runtime.

libtiff6

CVE-2026-4775, CVE-2026-12912

The affected code is not used at runtime.

libuuid1

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

libx11-6

CVE-2026-88806

The affected code is not used at runtime.

libx11-data

CVE-2026-88806

The affected code is not used at runtime.

libxml2

CVE-2026-86138, CVE-2026-86139, CVE-2026-86142, CVE-2026-86143, CVE-2026-86144

The affected code is not used at runtime.

libxpm4

CVE-2026-94287

The affected code is not used at runtime.

mount

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

openssl

CVE-2026-35189, CVE-2026-54872, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84782

The affected code is not used at runtime.

patch

CVE-2018-6952

The affected code is not used at runtime.

perl

CVE-2026-82560

The affected code is not used at runtime.

perl-base

CVE-2026-82560

The affected code is not used at runtime.

perl-modules-5.38

CVE-2026-82560

The affected code is not used at runtime.

python3.12

CVE-2026-57178, CVE-2026-84366

The affected code is not present in the version shipped.

python3.12

CVE-2026-7210, CVE-2026-11940, CVE-2026-11972, CVE-2026-19445, CVE-2026-19553, CVE-2026-82049

The affected code is not used at runtime.

python3.12-minimal

CVE-2026-57178, CVE-2026-84366

The affected code is not present in the version shipped.

python3.12-minimal

CVE-2026-7210, CVE-2026-11940, CVE-2026-11972, CVE-2026-19445, CVE-2026-19553, CVE-2026-82049

The affected code is not used at runtime.

util-linux

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

sm-translation-inference-server-16.2.0

Component

Identified CVEs

Reason

binutils

CVE-2025-66862, CVE-2025-66863, CVE-2025-66864, CVE-2025-66865, CVE-2025-66866, CVE-2026-3441, CVE-2026-3442, CVE-2026-6846

The affected code is not used at runtime.

binutils-common

CVE-2025-66862, CVE-2025-66863, CVE-2025-66864, CVE-2025-66865, CVE-2025-66866, CVE-2026-3441, CVE-2026-3442, CVE-2026-6846

The affected code is not used at runtime.

binutils-x86-64-linux-gnu

CVE-2025-66862, CVE-2025-66863, CVE-2025-66864, CVE-2025-66865, CVE-2025-66866, CVE-2026-3441, CVE-2026-3442, CVE-2026-6846

The affected code is not used at runtime.

bsdutils

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

cpp

CVE-2026-95619, CVE-2026-102010

The affected code is not used at runtime.

cpp-13

CVE-2026-95619, CVE-2026-102010

The affected code is not used at runtime.

cpp-13-x86-64-linux-gnu

CVE-2026-95619, CVE-2026-102010

The affected code is not used at runtime.

cpp-x86-64-linux-gnu

CVE-2026-95619, CVE-2026-102010

The affected code is not used at runtime.

cuda-compat-13-0

CVE-2026-47489, CVE-2026-47491, CVE-2026-47494, CVE-2026-47496, CVE-2026-47500, CVE-2026-47501, CVE-2026-47503, CVE-2026-47504, CVE-2026-47507, CVE-2026-47508, CVE-2026-47510, CVE-2026-47511, CVE-2026-47512, CVE-2026-47513, CVE-2026-47514, CVE-2026-47516, CVE-2026-47523, CVE-2026-47528, CVE-2026-47530, CVE-2026-47540, CVE-2026-47545, CVE-2026-47548, CVE-2026-47551, CVE-2026-47552, CVE-2026-47553, CVE-2026-47554, CVE-2026-47556, CVE-2026-47558, CVE-2026-47559, CVE-2026-47560, CVE-2026-47561, CVE-2026-47563, CVE-2026-47569, CVE-2026-47573, CVE-2026-47587, CVE-2026-47588, CVE-2026-47589, CVE-2026-47590, CVE-2026-47591, CVE-2026-47592, CVE-2026-47594, CVE-2026-47595, CVE-2026-47596, CVE-2026-47597, CVE-2026-47598, CVE-2026-47599, CVE-2026-47600, CVE-2026-47601, CVE-2026-47602

The affected code is not present in the version shipped.

gcc

CVE-2026-95619, CVE-2026-102010

The affected code is not used at runtime.

gcc-13

CVE-2026-95619, CVE-2026-102010

The affected code is not used at runtime.

gcc-13-base

CVE-2026-95619, CVE-2026-102010

The affected code is not used at runtime.

gcc-13-x86-64-linux-gnu

CVE-2026-95619, CVE-2026-102010

The affected code is not used at runtime.

gcc-x86-64-linux-gnu

CVE-2026-95619, CVE-2026-102010

The affected code is not used at runtime.

libbinutils

CVE-2025-66862, CVE-2025-66863, CVE-2025-66864, CVE-2025-66865, CVE-2025-66866, CVE-2026-3441, CVE-2026-3442, CVE-2026-6846

The affected code is not used at runtime.

libblkid1

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

libctf-nobfd0

CVE-2025-66862, CVE-2025-66863, CVE-2025-66864, CVE-2025-66865, CVE-2025-66866, CVE-2026-3441, CVE-2026-3442, CVE-2026-6846

The affected code is not used at runtime.

libctf0

CVE-2025-66862, CVE-2025-66863, CVE-2025-66864, CVE-2025-66865, CVE-2025-66866, CVE-2026-3441, CVE-2026-3442, CVE-2026-6846

The affected code is not used at runtime.

libexpat1

CVE-2026-93990, CVE-2026-102633

The affected code is not used at runtime.

libfdisk1

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

libfreetype6

CVE-2026-95512

The affected code is not used at runtime.

libgcc-13-dev

CVE-2026-95619, CVE-2026-102010

The affected code is not used at runtime.

libgprofng0

CVE-2025-66862, CVE-2025-66863, CVE-2025-66864, CVE-2025-66865, CVE-2025-66866, CVE-2026-3441, CVE-2026-3442, CVE-2026-6846

The affected code is not used at runtime.

libheif-plugin-aomdec

CVE-2026-84384, CVE-2026-84447, CVE-2026-84448, CVE-2026-84449

The affected code is not used at runtime.

libheif-plugin-aomenc

CVE-2026-84384, CVE-2026-84447, CVE-2026-84448, CVE-2026-84449

The affected code is not used at runtime.

libheif1

CVE-2026-84384, CVE-2026-84447, CVE-2026-84448, CVE-2026-84449

The affected code is not used at runtime.

libmount1

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

libpcre2-8-0

CVE-2026-86145, CVE-2026-89157, CVE-2026-89161, CVE-2026-103111

The affected code is not used at runtime.

libperl5.38t64

CVE-2026-82560

The affected code is not used at runtime.

libpython3.12-minimal

CVE-2026-57178, CVE-2026-84366

The affected code is not present in the version shipped.

libpython3.12-minimal

CVE-2026-7210, CVE-2026-11940, CVE-2026-11972, CVE-2026-19445, CVE-2026-19553, CVE-2026-82049

The affected code is not used at runtime.

libpython3.12-stdlib

CVE-2026-57178, CVE-2026-84366

The affected code is not present in the version shipped.

libpython3.12-stdlib

CVE-2026-7210, CVE-2026-11940, CVE-2026-11972, CVE-2026-19445, CVE-2026-19553, CVE-2026-82049

The affected code is not used at runtime.

libpython3.12t64

CVE-2026-57178, CVE-2026-84366

The affected code is not present in the version shipped.

libpython3.12t64

CVE-2026-7210, CVE-2026-11940, CVE-2026-11972, CVE-2026-19445, CVE-2026-19553, CVE-2026-82049

The affected code is not used at runtime.

libsframe1

CVE-2025-66862, CVE-2025-66863, CVE-2025-66864, CVE-2025-66865, CVE-2025-66866, CVE-2026-3441, CVE-2026-3442, CVE-2026-6846

The affected code is not used at runtime.

libsmartcols1

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

libssl3t64

CVE-2026-35189, CVE-2026-54872, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84782

The affected code is not used at runtime.

libtiff6

CVE-2026-4775, CVE-2026-12912

The affected code is not used at runtime.

libuuid1

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

libx11-6

CVE-2026-88806

The affected code is not used at runtime.

libx11-data

CVE-2026-88806

The affected code is not used at runtime.

libxml2

CVE-2026-86138, CVE-2026-86139, CVE-2026-86142, CVE-2026-86143, CVE-2026-86144

The affected code is not used at runtime.

libxpm4

CVE-2026-94287

The affected code is not used at runtime.

mount

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

openssl

CVE-2026-35189, CVE-2026-54872, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84782

The affected code is not used at runtime.

patch

CVE-2018-6952

The affected code is not used at runtime.

perl

CVE-2026-82560

The affected code is not used at runtime.

perl-base

CVE-2026-82560

The affected code is not used at runtime.

perl-modules-5.38

CVE-2026-82560

The affected code is not used at runtime.

python3.12

CVE-2026-57178, CVE-2026-84366

The affected code is not present in the version shipped.

python3.12

CVE-2026-7210, CVE-2026-11940, CVE-2026-11972, CVE-2026-19445, CVE-2026-19553, CVE-2026-82049

The affected code is not used at runtime.

python3.12-minimal

CVE-2026-57178, CVE-2026-84366

The affected code is not present in the version shipped.

python3.12-minimal

CVE-2026-7210, CVE-2026-11940, CVE-2026-11972, CVE-2026-19445, CVE-2026-19553, CVE-2026-82049

The affected code is not used at runtime.

util-linux

CVE-2026-76642, CVE-2026-78408, CVE-2026-78409, CVE-2026-78410

The affected code is not used at runtime.

Reviewed, no upstream fix available

The following vulnerabilities were reviewed and do apply to this release, with no fix released upstream at the time of writing. They are tracked and will be taken up when a fix becomes available.

batch-asr-transcriber-16.2.0

Component

Identified CVEs

glib-networking

CVE-2026-10028

glib-networking-common

CVE-2026-10028

glib-networking-services

CVE-2026-10028

libfluidsynth3

CVE-2025-56225

libopenh264-7

CVE-2025-27091

libopenjp2-7

CVE-2023-39328, CVE-2023-39329

libxml2

CVE-2026-86138, CVE-2026-86143

Batch ContainerRealtime ContainerGPU Transcription Inference ContainerGPU Translation Inference Container

1.3.0 - Melia 1 Containers

Version 1.3.0 is now available for the Melia 1 Container (Batch Transcriber and GPU Transcription Inference Container).

New

Introducing Melia 1 - our brand new model for multilingual transcription capable of handling production-scale traffic for multilingual use cases. Refer to the documentation for more details.

Melia 1 allows us to transcribe any of our 55+ languages without having to specify languages up front. Accuracy is already superior to our Standard model while offering lower processing costs.

Key features

  • Multilingual transcription with language labelling

  • Code-switching between languages, particularly when switching between English and Spanish, Arabic, Mandarin, Malay or Tamil.

  • Optional language hints

  • Blazingly fast turnaround time

Security fixes

Vulnerability management

  • Software Bill of Materials (SBOM) is available for download from the corresponding release page in our Support Portal.

  • OpenVEX statements are also available for each image, download from the corresponding release page in our Support Portal. These encode our assessment of CVEs that don't affect this release.

Non-applicable CVEs

The following vulnerabilities were reviewed and determined to have no security impact for this release.

Container

Component

Identified CVEs

Reason

Transcriber

libgstreamer

CVE-2025-3887

Manually patched (build 1.24.2-sm-1320260); scanners may still flag it because the base version string remains unchanged

Transcriber

ffmpeg and bundled codec libraries (libopenexr, libmfx1, libde265, libzvbi, libopenh264, libopenjp2, libvo-amrwbenc, libsndfile)

Multiple CVEs — see attached OpenVEX file for full per-CVE list

False positives: most stem from scanners matching against an older ffmpeg version tracker rather than the newer Speechmatics build (8.1.1) actually shipped; the rest are codec paths (video encode/decode, teletext, JPEG2000, etc.) never invoked by our audio-only decode-to-WAV pipeline

Transcriber

transformers

CVE-2026-4372, CVE-2026-1839

Deployed code only uses tokenization (AutoTokenizer/AutoConfig) on bundled files; the vulnerable model-load path is never invoked

Transcriber

python3-pip (vendored urllib3/requests)

CVE-2024-35195, CVE-2025-66418, CVE-2025-66471, CVE-2026-21441, CVE-2026-1703

Build/install-time only, not on any runtime path

Transcriber

libsoup-3.0-0 / libsoup-3.0-common

CVE-2025-14523, CVE-2025-32049, CVE-2025-4035, CVE-2026-0716, CVE-2026-0719, CVE-2026-3632, CVE-2026-3633, CVE-2026-3634, CVE-2025-9901, CVE-2026-3099

Not used by any pipeline; outbound HTTP uses the Python requests/urllib3 stack

Transcriber

libp11-kit0

CVE-2026-13757

p11-kit RPC server/proxy not used

Transcriber

glib-networking family

CVE-2026-10028

TLS backend reached only via libsoup, which no pipeline uses

Transcriber

libcurl3t64-gnutls

CVE-2026-11856, CVE-2026-10536, CVE-2026-12064

No SMB usage and no gstreamer-curl plugin in any pipeline; outbound HTTP uses the Python requests/urllib3 stack

GPU Inference Server

libcurl3t64-gnutls

CVE-2026-11856, CVE-2026-8925, CVE-2026-8927, CVE-2026-10536, CVE-2026-12064, CVE-2026-8286, CVE-2026-8458, CVE-2026-8924, CVE-2026-9547

Orphan package (empty reverse-dependency set); no installed runtime component links or invokes it

GPU Inference Server

setuptools, wheel

CVE-2024-6345, CVE-2025-47273, CVE-2026-24049

Base-image packaging tooling not invoked at inference runtime

GPU Inference Server

transformers

CVE-2026-4372, CVE-2026-1839

Only the fast tokenizer is used; the checkpoint-deserialization/model-load path is never invoked

Batch ContainerGPU Transcription Inference Container

15.14.0 - Containers

Version 15.14.0 is now available for Batch Container, Realtime Container, GPU Transcription Inference Container and GPU Translation Inference Container.

New

GPU & CPU

  • Added a new model property in transcription config for selecting Standard or Enhanced models. See the documentation for more details.

GPU

  • Added support for NVIDIA Blackwell architecture GPUs.

Improvements

GPU

  • New Enhanced model for French (fr) and Russian (ru) give up to 2% relative accuracy improvement.

  • New Enhanced model for German (de) improves accuracy on numerical digit sequences, formatting consistency of alphanumeric entities, and punctuation and numerical entity interactions, resulting in more consistent formatting.

GPU & CPU

  • New Standard and Enhanced models for Norwegian (no) improve the formatting of alphanumeric entities, with additional support for correctly handling:

    • Traditional compounded cardinals

    • Approximate ranges

    • Blood pressure measurements

  • Improved the handling of ForceEndOfUtterance to avoid suppressing zero-duration final transcripts.

Deprecated

GPU & CPU

  • The operating_point property in transcription config is deprecated in favour of the new model property for model selection. See the documentation for more details.

Security fixes

Vulnerability management

  • Software Bill of Materials (SBOM) is available for download from the corresponding release page in our Support Portal.

  • OpenVEX statements are also available for each image, download from the corresponding release page in our Support Portal. These encode our assessment of CVEs that don't affect this release.

Non-applicable CVEs

The following vulnerabilities were reviewed and determined to have no security impact for this release.

Container

Component

Identified CVEs

Reason

Transcriber (Batch, Realtime)

libgstreamer

CVE-2025-3887

Manually patched (build 1.24.2-sm-1320260); scanners may still flag it because the base version string remains unchanged

Transcriber (Batch, Realtime)

ffmpeg and bundled codec libraries (libopenexr, libmfx1, libde265, libzvbi, libopenh264, libopenjp2, libvo-amrwbenc, libsndfile, libsoup, libcurl, libp11-kit, glib-networking)

Multiple CVEs - Refer OpenVEX file for full per-CVE list

False positives: most stem from scanners matching against an older ffmpeg version tracker rather than the newer Speechmatics build (8.1.1) actually shipped; the rest are codec paths (video encode/decode, teletext, JPEG2000, etc.) never invoked by our audio-only decode-to-WAV pipeline

Transcriber (Batch, Realtime)

transformers

CVE-2026-1839

Checkpoint-deserialization path not invoked at runtime

Transcriber (Batch, Realtime)

python3-pip (vendored urllib3/requests)

CVE-2024-35195, CVE-2025-66418, CVE-2025-66471, CVE-2026-21441, CVE-2026-1703

Build/install-time only, not on any runtime path

GPU Inference Server (Transcription and Translation)

wheel, setuptools

CVE-2026-24049, CVE-2024-6345, CVE-2025-47273

Base-image packaging tooling not invoked at inference runtime

‌

Batch ContainerRealtime ContainerGPU Transcription Inference ContainerGPU Translation Inference Container

Earlier updates