CVE-2026-108960 PUBLISHED

Tiiny-AI PowerInfer FFN GPU-split Loader ggml-cuda.cu create_striped_mat_to_gpu out-of-bounds

Assigner: VulDB
Reserved: 11.10.2026 Published: 13.10.2026 Updated: 13.10.2026

A vulnerability was detected in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Affected is the function create_striped_mat_to_gpu of the file smallthinker/ggml/src/ggml-cuda/ggml-cuda.cu of the component FFN GPU-split Loader. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The pull request to fix this issue awaits acceptance.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS Score: 4.8

Product Status

Vendor Tiiny-AI
Product PowerInfer
Versions
  • Version 8bd56d69906c9d2dba4d3bf6899763401e01a9a4 is affected

Credits

  • Dem0 (VulDB User) reporter
  • VulDB CNA Team coordinator

References

Problem Types

  • Out-of-Bounds Read CWE
  • Memory Corruption CWE