Search
Find a vulnerability
Search criteria
4 vulnerabilities found for PowerInfer by Tiiny-AI
CVE-2026-108960 (GCVE-0-2026-108960)
Vulnerability from nvd – Published: 2026-10-13 03:00 – Updated: 2026-10-13 13:28
VLAI
EPSS
VEX
Title
Tiiny-AI PowerInfer FFN GPU-split Loader ggml-cuda.cu create_striped_mat_to_gpu out-of-bounds
Summary
A vulnerability was detected in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Affected is the function create_striped_mat_to_gpu of the file smallthinker/ggml/src/ggml-cuda/ggml-cuda.cu of the component FFN GPU-split Loader. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The pull request to fix this issue awaits acceptance.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 13:27 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/416779 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/416779/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-108960 | third-party-advisory |
| https://vuldb.com/submit/997933 | third-party-advisory |
| https://github.com/Tiiny-AI/PowerInfer/issues/284 | exploitissue-tracking |
| https://github.com/Tiiny-AI/PowerInfer/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tiiny-AI | PowerInfer |
Affected:
8bd56d69906c9d2dba4d3bf6899763401e01a9a4
cpe:2.3:a:tiiny-ai:powerinfer:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108960",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T13:27:26.959231Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T13:28:01.770Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:tiiny-ai:powerinfer:*:*:*:*:*:*:*:*"
],
"modules": [
"FFN GPU-split Loader"
],
"product": "PowerInfer",
"vendor": "Tiiny-AI",
"versions": [
{
"status": "affected",
"version": "8bd56d69906c9d2dba4d3bf6899763401e01a9a4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dem0 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Affected is the function create_striped_mat_to_gpu of the file smallthinker/ggml/src/ggml-cuda/ggml-cuda.cu of the component FFN GPU-split Loader. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The pull request to fix this issue awaits acceptance."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.3,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-Bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T03:00:18.429Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-416779 | Tiiny-AI PowerInfer FFN GPU-split Loader ggml-cuda.cu create_striped_mat_to_gpu out-of-bounds",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/416779"
},
{
"name": "VDB-416779 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/416779/cti"
},
{
"name": "CVE-2026-108960 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-108960"
},
{
"name": "Submit #997933 | https://github.com/Tiiny-AI/PowerInfer/issues/284 PowerInfer commit 8bd56d69906c9d2dba4d3bf6899763401e01a9a4 (main, 2026-05-11) Out-of-bounds Read",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/997933"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/Tiiny-AI/PowerInfer/issues/284"
},
{
"tags": [
"product"
],
"url": "https://github.com/Tiiny-AI/PowerInfer/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-11T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-11T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-11T21:33:28.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tiiny-AI PowerInfer FFN GPU-split Loader ggml-cuda.cu create_striped_mat_to_gpu out-of-bounds",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-108960",
"datePublished": "2026-10-13T03:00:18.429Z",
"dateReserved": "2026-10-11T19:28:22.873Z",
"dateUpdated": "2026-10-13T13:28:01.770Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108955 (GCVE-0-2026-108955)
Vulnerability from nvd – Published: 2026-10-13 01:45 – Updated: 2026-10-13 01:45
VLAI
EPSS
VEX
Title
Tiiny-AI PowerInfer GGUF ggml.c gguf_init_from_file out-of-bounds
Summary
A vulnerability was determined in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Impacted is the function gguf_init_from_file of the file ggml.c of the component GGUF Parser. This manipulation of the argument data_offset causes out-of-bounds read. The attack requires local access. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The pull request to fix this issue awaits acceptance.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/416774 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/416774/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-108955 | third-party-advisory |
| https://vuldb.com/submit/997844 | third-party-advisory |
| https://github.com/Tiiny-AI/PowerInfer/issues/283 | exploitissue-tracking |
| https://github.com/Tiiny-AI/PowerInfer/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tiiny-AI | PowerInfer |
Affected:
8bd56d69906c9d2dba4d3bf6899763401e01a9a4
cpe:2.3:a:tiiny-ai:powerinfer:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:tiiny-ai:powerinfer:*:*:*:*:*:*:*:*"
],
"modules": [
"GGUF Parser"
],
"product": "PowerInfer",
"vendor": "Tiiny-AI",
"versions": [
{
"status": "affected",
"version": "8bd56d69906c9d2dba4d3bf6899763401e01a9a4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "dem0000 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Impacted is the function gguf_init_from_file of the file ggml.c of the component GGUF Parser. This manipulation of the argument data_offset causes out-of-bounds read. The attack requires local access. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The pull request to fix this issue awaits acceptance."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.3,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-Bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T01:45:17.192Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-416774 | Tiiny-AI PowerInfer GGUF ggml.c gguf_init_from_file out-of-bounds",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/416774"
},
{
"name": "VDB-416774 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/416774/cti"
},
{
"name": "CVE-2026-108955 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-108955"
},
{
"name": "Submit #997844 | Tiiny-AI PowerInfer up to main commit 8bd56d69906c9d2dba4d3bf6899763401e01a9a4 Out-of-Bounds (CWE-125)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/997844"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/Tiiny-AI/PowerInfer/issues/283"
},
{
"tags": [
"product"
],
"url": "https://github.com/Tiiny-AI/PowerInfer/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-11T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-11T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-11T21:16:30.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tiiny-AI PowerInfer GGUF ggml.c gguf_init_from_file out-of-bounds",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-108955",
"datePublished": "2026-10-13T01:45:17.192Z",
"dateReserved": "2026-10-11T19:11:22.275Z",
"dateUpdated": "2026-10-13T01:45:17.192Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108960 (GCVE-0-2026-108960)
Vulnerability from cvelistv5 – Published: 2026-10-13 03:00 – Updated: 2026-10-13 13:28
VLAI
EPSS
VEX
Title
Tiiny-AI PowerInfer FFN GPU-split Loader ggml-cuda.cu create_striped_mat_to_gpu out-of-bounds
Summary
A vulnerability was detected in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Affected is the function create_striped_mat_to_gpu of the file smallthinker/ggml/src/ggml-cuda/ggml-cuda.cu of the component FFN GPU-split Loader. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The pull request to fix this issue awaits acceptance.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 13:27 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/416779 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/416779/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-108960 | third-party-advisory |
| https://vuldb.com/submit/997933 | third-party-advisory |
| https://github.com/Tiiny-AI/PowerInfer/issues/284 | exploitissue-tracking |
| https://github.com/Tiiny-AI/PowerInfer/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tiiny-AI | PowerInfer |
Affected:
8bd56d69906c9d2dba4d3bf6899763401e01a9a4
cpe:2.3:a:tiiny-ai:powerinfer:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108960",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T13:27:26.959231Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T13:28:01.770Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:tiiny-ai:powerinfer:*:*:*:*:*:*:*:*"
],
"modules": [
"FFN GPU-split Loader"
],
"product": "PowerInfer",
"vendor": "Tiiny-AI",
"versions": [
{
"status": "affected",
"version": "8bd56d69906c9d2dba4d3bf6899763401e01a9a4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dem0 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Affected is the function create_striped_mat_to_gpu of the file smallthinker/ggml/src/ggml-cuda/ggml-cuda.cu of the component FFN GPU-split Loader. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The pull request to fix this issue awaits acceptance."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.3,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-Bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T03:00:18.429Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-416779 | Tiiny-AI PowerInfer FFN GPU-split Loader ggml-cuda.cu create_striped_mat_to_gpu out-of-bounds",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/416779"
},
{
"name": "VDB-416779 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/416779/cti"
},
{
"name": "CVE-2026-108960 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-108960"
},
{
"name": "Submit #997933 | https://github.com/Tiiny-AI/PowerInfer/issues/284 PowerInfer commit 8bd56d69906c9d2dba4d3bf6899763401e01a9a4 (main, 2026-05-11) Out-of-bounds Read",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/997933"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/Tiiny-AI/PowerInfer/issues/284"
},
{
"tags": [
"product"
],
"url": "https://github.com/Tiiny-AI/PowerInfer/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-11T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-11T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-11T21:33:28.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tiiny-AI PowerInfer FFN GPU-split Loader ggml-cuda.cu create_striped_mat_to_gpu out-of-bounds",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-108960",
"datePublished": "2026-10-13T03:00:18.429Z",
"dateReserved": "2026-10-11T19:28:22.873Z",
"dateUpdated": "2026-10-13T13:28:01.770Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108955 (GCVE-0-2026-108955)
Vulnerability from cvelistv5 – Published: 2026-10-13 01:45 – Updated: 2026-10-13 01:45
VLAI
EPSS
VEX
Title
Tiiny-AI PowerInfer GGUF ggml.c gguf_init_from_file out-of-bounds
Summary
A vulnerability was determined in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Impacted is the function gguf_init_from_file of the file ggml.c of the component GGUF Parser. This manipulation of the argument data_offset causes out-of-bounds read. The attack requires local access. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The pull request to fix this issue awaits acceptance.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/416774 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/416774/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-108955 | third-party-advisory |
| https://vuldb.com/submit/997844 | third-party-advisory |
| https://github.com/Tiiny-AI/PowerInfer/issues/283 | exploitissue-tracking |
| https://github.com/Tiiny-AI/PowerInfer/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tiiny-AI | PowerInfer |
Affected:
8bd56d69906c9d2dba4d3bf6899763401e01a9a4
cpe:2.3:a:tiiny-ai:powerinfer:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:tiiny-ai:powerinfer:*:*:*:*:*:*:*:*"
],
"modules": [
"GGUF Parser"
],
"product": "PowerInfer",
"vendor": "Tiiny-AI",
"versions": [
{
"status": "affected",
"version": "8bd56d69906c9d2dba4d3bf6899763401e01a9a4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "dem0000 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Impacted is the function gguf_init_from_file of the file ggml.c of the component GGUF Parser. This manipulation of the argument data_offset causes out-of-bounds read. The attack requires local access. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The pull request to fix this issue awaits acceptance."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.3,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-Bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T01:45:17.192Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-416774 | Tiiny-AI PowerInfer GGUF ggml.c gguf_init_from_file out-of-bounds",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/416774"
},
{
"name": "VDB-416774 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/416774/cti"
},
{
"name": "CVE-2026-108955 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-108955"
},
{
"name": "Submit #997844 | Tiiny-AI PowerInfer up to main commit 8bd56d69906c9d2dba4d3bf6899763401e01a9a4 Out-of-Bounds (CWE-125)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/997844"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/Tiiny-AI/PowerInfer/issues/283"
},
{
"tags": [
"product"
],
"url": "https://github.com/Tiiny-AI/PowerInfer/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-11T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-11T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-11T21:16:30.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tiiny-AI PowerInfer GGUF ggml.c gguf_init_from_file out-of-bounds",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-108955",
"datePublished": "2026-10-13T01:45:17.192Z",
"dateReserved": "2026-10-11T19:11:22.275Z",
"dateUpdated": "2026-10-13T01:45:17.192Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}