Search
Find a vulnerability
Search criteria
2 vulnerabilities found for ppl.nn by OpenPPL
CVE-2026-122189 (GCVE-0-2026-122189)
Vulnerability from nvd – Published: 2026-11-05 03:00 – Updated: 2026-11-05 20:51
VLAI
EPSS
VEX
Title
OpenPPL ppl.nn CUDA Optimizer opt_graph.cc InitQuantization out-of-bounds
Summary
A vulnerability has been found in OpenPPL ppl.nn up to bb84dc9952809b3a5a0036858a3d9f68af1c83d5. The affected element is the function OptGraph::InitQuantization of the file src/ppl/nn/engines/cuda/optimizer/opt_graph.cc of the component CUDA Optimizer. Such manipulation of the argument per_channel/bit_width/tensor_max/tensor_min/scale leads to out-of-bounds read. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 20:51 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/431163 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/431163/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-122189 | third-party-advisory |
| https://vuldb.com/submit/1028313 | third-party-advisory |
| https://github.com/OpenPPL/ppl.nn/issues/975 | issue-tracking |
| https://github.com/user-attachments/files/3339300… | exploit |
| https://github.com/OpenPPL/ppl.nn/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-122189",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T20:51:35.756999Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T20:51:45.837Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:openppl:ppl.nn:*:*:*:*:*:*:*:*"
],
"modules": [
"CUDA Optimizer"
],
"product": "ppl.nn",
"vendor": "OpenPPL",
"versions": [
{
"status": "affected",
"version": "bb84dc9952809b3a5a0036858a3d9f68af1c83d5"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dem000000 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in OpenPPL ppl.nn up to bb84dc9952809b3a5a0036858a3d9f68af1c83d5. The affected element is the function OptGraph::InitQuantization of the file src/ppl/nn/engines/cuda/optimizer/opt_graph.cc of the component CUDA Optimizer. Such manipulation of the argument per_channel/bit_width/tensor_max/tensor_min/scale leads to out-of-bounds read. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-Bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T03:00:48.902Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-431163 | OpenPPL ppl.nn CUDA Optimizer opt_graph.cc InitQuantization out-of-bounds",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/431163"
},
{
"name": "VDB-431163 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/431163/cti"
},
{
"name": "CVE-2026-122189 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-122189"
},
{
"name": "Submit #1028313 | OpenPPL ppl.nn commit bb84dc9952809b3a5a0036858a3d9f68af1c83d5 Out-of-bounds Read",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1028313"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/OpenPPL/ppl.nn/issues/975"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/user-attachments/files/33393000/poc.zip"
},
{
"tags": [
"product"
],
"url": "https://github.com/OpenPPL/ppl.nn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-04T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-04T20:14:03.000Z",
"value": "VulDB entry last update"
}
],
"title": "OpenPPL ppl.nn CUDA Optimizer opt_graph.cc InitQuantization out-of-bounds",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-122189",
"datePublished": "2026-11-05T03:00:48.902Z",
"dateReserved": "2026-11-04T19:08:58.956Z",
"dateUpdated": "2026-11-05T20:51:45.837Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-122189 (GCVE-0-2026-122189)
Vulnerability from cvelistv5 – Published: 2026-11-05 03:00 – Updated: 2026-11-05 20:51
VLAI
EPSS
VEX
Title
OpenPPL ppl.nn CUDA Optimizer opt_graph.cc InitQuantization out-of-bounds
Summary
A vulnerability has been found in OpenPPL ppl.nn up to bb84dc9952809b3a5a0036858a3d9f68af1c83d5. The affected element is the function OptGraph::InitQuantization of the file src/ppl/nn/engines/cuda/optimizer/opt_graph.cc of the component CUDA Optimizer. Such manipulation of the argument per_channel/bit_width/tensor_max/tensor_min/scale leads to out-of-bounds read. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 20:51 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/431163 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/431163/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-122189 | third-party-advisory |
| https://vuldb.com/submit/1028313 | third-party-advisory |
| https://github.com/OpenPPL/ppl.nn/issues/975 | issue-tracking |
| https://github.com/user-attachments/files/3339300… | exploit |
| https://github.com/OpenPPL/ppl.nn/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-122189",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T20:51:35.756999Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T20:51:45.837Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:openppl:ppl.nn:*:*:*:*:*:*:*:*"
],
"modules": [
"CUDA Optimizer"
],
"product": "ppl.nn",
"vendor": "OpenPPL",
"versions": [
{
"status": "affected",
"version": "bb84dc9952809b3a5a0036858a3d9f68af1c83d5"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dem000000 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in OpenPPL ppl.nn up to bb84dc9952809b3a5a0036858a3d9f68af1c83d5. The affected element is the function OptGraph::InitQuantization of the file src/ppl/nn/engines/cuda/optimizer/opt_graph.cc of the component CUDA Optimizer. Such manipulation of the argument per_channel/bit_width/tensor_max/tensor_min/scale leads to out-of-bounds read. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-Bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T03:00:48.902Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-431163 | OpenPPL ppl.nn CUDA Optimizer opt_graph.cc InitQuantization out-of-bounds",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/431163"
},
{
"name": "VDB-431163 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/431163/cti"
},
{
"name": "CVE-2026-122189 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-122189"
},
{
"name": "Submit #1028313 | OpenPPL ppl.nn commit bb84dc9952809b3a5a0036858a3d9f68af1c83d5 Out-of-bounds Read",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1028313"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/OpenPPL/ppl.nn/issues/975"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/user-attachments/files/33393000/poc.zip"
},
{
"tags": [
"product"
],
"url": "https://github.com/OpenPPL/ppl.nn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-04T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-04T20:14:03.000Z",
"value": "VulDB entry last update"
}
],
"title": "OpenPPL ppl.nn CUDA Optimizer opt_graph.cc InitQuantization out-of-bounds",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-122189",
"datePublished": "2026-11-05T03:00:48.902Z",
"dateReserved": "2026-11-04T19:08:58.956Z",
"dateUpdated": "2026-11-05T20:51:45.837Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}