PowerInfer CVE-2026-108955

Exploitation requires local access to a system running Tiiny-AI PowerInfer and the ability to have a crafted GGUF model file parsed by the gguf_init_from_file function (GGUF Parser) with a manipulated data_offset argument - i.e., the attacker must control or substitute the model file that PowerInfer loads. Per the CVSS vector (AV:L/PR:L/UI:N), the attacker needs local presence and at least low-level privileges but no user interaction. Limiting factors: no remote network vector, the attacker cannot trigger this purely remotely, impact is confined to an out-of-bounds read (information disclosure or crash rather than code execution per the Low C/I/A ratings), and there is no accepted upstream patch yet, so defenders must rely on controlling which GGUF files are loaded.

This is a genuinely low-priority issue despite being a publicly disclosed vulnerability, and the signals are mostly consistent in pointing that way. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) and the low base score of 1.9 indicate a vulnerability that requires local access and at least low-level privileges, with only limited (Low) impact to confidentiality, integrity, and availability - appropriate for a CWE-125 out-of-bounds read triggered by a crafted GGUF model file. It is NOT in CISA KEV, so there is no confirmed active exploitation; the only elevated signal is that public exploit/PoC material exists (the vendor GitHub issue #283). No EPSS score was provided in the input, so exploitation-probability cannot be compared quantitatively. The SSVC/threat sub-vector carries E:P (Proof-of-Concept), which aligns with the PoC-exists signal rather than active exploitation. In short: publicly available exploit code exists but there is no evidence of in-the-wild use, the impact is bounded to an out-of-bounds read (primarily information disclosure or a crash), and exploitation is gated behind local access plus the ability to get the target to parse a malicious GGUF file. No conflicting signals of note, though the absence of EPSS and the unresolved upstream patch (PR awaiting acceptance) are gaps.

A local attacker crafts a malicious GGUF model file with a manipulated data_offset field and convinces a user or process to load it with PowerInfer, causing gguf_init_from_file in ggml.c to read out of bounds. Publicly available exploit material is referenced in the vendor's GitHub issue #283. Given AV:L/PR:L, this is realistically limited to scenarios where the attacker can already supply files on the system or influence which model file is loaded.