Description
A vulnerability was detected in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Affected is the function create_striped_mat_to_gpu of the file smallthinker/ggml/src/ggml-cuda/ggml-cuda.cu of the component FFN GPU-split Loader. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The pull request to fix this issue awaits acceptance.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Tiiny-AI | PowerInfer | 8bd56d69906c9d2dba4d3bf6899763401e01a9a4 | — |
References
- VDB-416779 | Tiiny-AI PowerInfer FFN GPU-split Loader ggml-cuda.cu create_striped_mat_to_gpu out-of-bounds vdb-entry technical-description
- VDB-416779 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-108960 | CVE Analysis and Report third-party-advisory
- Submit #997933 | https://github.com/Tiiny-AI/PowerInfer/issues/284 PowerInfer commit 8bd56d69906c9d2dba4d3bf6899763401e01a9a4 (main, 2026-05-11) Out-of-bounds Read third-party-advisory
- https://github.com/Tiiny-AI/PowerInfer/issues/284 exploit issue-tracking
- https://github.com/Tiiny-AI/PowerInfer/ product