CVE-2026-108955 Details
Description
A vulnerability was determined in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Impacted is the function gguf_init_from_file of the file ggml.c of the component GGUF Parser. This manipulation of the argument data_offset causes out-of-bounds read. The attack requires local access. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The pull request to fix this issue awaits acceptance.
A vulnerability in Tiiny-AI PowerInfer versions up to commit 8bd56d69906c9d2dba4d3bf6899763401e01a9a4 allows for an out-of-bounds read. This issue arises in the GGUF Parser component, specifically within the 'gguf_init_from_file' function in 'ggml.c'. The vulnerability is triggered by improper validation of tensor data offsets, which can lead to reading memory outside the intended bounds. This flaw requires local access to exploit and has been publicly disclosed.
A pull request to fix this vulnerability is pending acceptance.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Tiiny-AI/PowerInfer/ | [email protected] | Source CodeVendor |
| https://github.com/Tiiny-AI/PowerInfer/issues/283 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-108955 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/997844 | [email protected] | Permission Required |
| https://vuldb.com/vuln/416774 | [email protected] | Permission Required |
| https://vuldb.com/vuln/416774/cti | [email protected] | AdvisoryContent Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | [email protected] |
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tiiny-AI PowerInfer | <= 8bd56d69906c9d2dba4d3bf6899763401e01a9a4 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |