Description
A vulnerability was determined in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Impacted is the function gguf_init_from_file of the file ggml.c of the component GGUF Parser. This manipulation of the argument data_offset causes out-of-bounds read. The attack requires local access. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The pull request to fix this issue awaits acceptance.
Published: 2026-10-13
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Out-of-bounds Read
Action: Apply Latest Patch
AI Analysis

Impact

The vulnerability is located in the gguf_init_from_file function of PowerInfer's ggml.c file, where manipulation of the data_offset argument triggers an out-of-bounds read. This flaw can allow a local attacker to read memory beyond the intended buffer, potentially exposing sensitive data or causing a program crash. The CVSS score of 4.8 indicates moderate severity, and the publicly disclosed exploit demonstrates that abuse is feasible.

Affected Systems

All releases of Tiiny-AI PowerInfer that include the ggml.c GGUF parser prior to the yet-merged fix commit 8bd56d69906c9d2dba4d3bf6899763401e01a9a4 are vulnerable. Because the product follows a rolling release model, specific patch versions are not listed, so any installation of PowerInfer that incorporates the referenced code path is at risk.

Risk and Exploitability

The flaw requires local access; therefore, the threat surface is limited to users who can run or influence PowerInfer on the system. EPSS data is not available, but the vulnerability has been publicly disclosed and exploited, indicating a non-negligible risk. The issue is not in the CISA KEV catalog, yet the impact of read corruption warrants cautious monitoring until the patch is applied.

Generated by OpenCVE AI on October 13, 2026 at 03:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update to the latest version of Tiiny-AI PowerInfer once the pending fix commits are merged and released.
  • If an update is not immediately possible, run PowerInfer with the least privileges and ensure that only trusted, controlled data files are accessed by the gguf parser.
  • Minimize local attack vectors by restricting file system access to the process and using sandboxing or containerization to isolate PowerInfer from the broader environment.
  • Enable compiler level protections such as stack canaries, relative addressing, and ASLR if recompilation is feasible; these mitigate the effects of the out-of-bounds read.

Generated by OpenCVE AI on October 13, 2026 at 03:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 02:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Impacted is the function gguf_init_from_file of the file ggml.c of the component GGUF Parser. This manipulation of the argument data_offset causes out-of-bounds read. The attack requires local access. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The pull request to fix this issue awaits acceptance.
Title Tiiny-AI PowerInfer GGUF ggml.c gguf_init_from_file out-of-bounds
First Time appeared Tiiny-ai
Tiiny-ai powerinfer
Weaknesses CWE-119
CWE-125
CPEs cpe:2.3:a:tiiny-ai:powerinfer:*:*:*:*:*:*:*:*
Vendors & Products Tiiny-ai
Tiiny-ai powerinfer
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tiiny-ai Powerinfer
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-15T15:13:44.948Z

Reserved: 2026-10-11T19:11:22.275Z

Link: CVE-2026-108955

cve-icon Vulnrichment

Updated: 2026-10-15T14:50:21.716Z

cve-icon NVD

Status : Deferred

Published: 2026-10-13T02:16:57.690

Modified: 2026-10-15T16:17:41.780

Link: CVE-2026-108955

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T07:23:39Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-125

    Out-of-bounds Read