EUVD-2026-98270
GHSA-p4fx-7pm7-23jr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privileged access
-
ExploitSupply crafted model/FFN split input
-
ExecutionTrigger OOB read in create_striped_mat_to_gpu
-
ImpactDisclose adjacent memory or crash process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local access to a host running Tiiny-AI PowerInfer with low-level authenticated privileges (PR:L) sufficient to invoke the FFN GPU-split Loader - i.e., the ability to supply or influence the model/matrix input processed by create_striped_mat_to_gpu in the CUDA backend. Exploitation is limited by: no remote vector (AV:L, attacker must be on the machine), the need for an existing local account, and a CUDA-capable GPU deployment actually exercising the GPU-split FFN loading path. No user interaction is needed (UI:N), and impact is confined to the local process (no scope change). No fixed release currently exists (rolling release, patch PR pending). |
| Impact | This is a genuinely low-priority issue despite being publicly exploitable. All signals align toward low real-world risk: the vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) scores only 1.9, reflecting that an attacker must already have local, authenticated access (PR:L) to the system running PowerInfer, and the technical impact is limited to low confidentiality/integrity/availability (VC:L/VI:L/VA:L, SC/SI/SA:N - no scope change). A public exploit exists (E:P, referenced GitHub issue #284), which is why POC availability is confirmed, but this is NOT the same as active exploitation: there is no CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of widespread or opportunistic exploitation. CWE-125 (out-of-bounds read) in a CUDA tensor-loading routine typically leaks adjacent GPU/host memory or crashes the process rather than enabling code execution, consistent with the low impact metrics. Note a minor inconsistency: the input 4.0 vector claims integrity impact (VI:L), but an out-of-bounds READ does not normally corrupt data - this likely overstates integrity and should be verified against the actual patch. Bottom line: a local, low-privilege, low-impact bug in a niche open-source inference engine - real but not urgent. |
| Exploit ScenarioDerived | A local user with low privileges on a machine running Tiiny-AI PowerInfer supplies a crafted model or FFN GPU-split configuration that drives create_striped_mat_to_gpu to read past the bounds of an allocated buffer during CUDA matrix loading. This leaks adjacent memory contents or crashes the inference process. A public proof-of-concept exists in the project's GitHub issue tracker (#284), lowering the effort to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
An out-of-bounds read in Tiiny-AI PowerInfer's CUDA backend lets a local, authenticated user crash or partially disclose memory by supplying a crafted model or matrix input to the FFN GPU-split loader path (create_striped_mat_to_gpu in smallthinker/ggml/src/ggml-cuda/ggml-cuda.cu). Exploitation requires an existing low-privileged local account and a CUDA-capable deployment that actually exercises the GPU-split FFN loading path; there is no remote vector and impact is confined to the local process (CWE-125, CVSS 4.0 base 1.9, assessed 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L). Publicly available exploit code exists (referenced via the project's GitHub issue tracker), but there is no confirmed active exploitation (no CISA KEV listing), and the overall risk is low. PowerInfer uses a rolling release model, so no affected or fixed version numbers are disclosed, and the proposed fix pull request awaits acceptance.
RemediationAI
No vendor-released patch identified at time of analysis - PowerInfer is a rolling-release project, so there is no tagged fixed version; a fix pull request is tracked against the codebase but awaits acceptance (see the publicly referenced issue at https://github.com/Tiiny-AI/PowerInfer/issues/284 and the advisory at https://vuldb.com/vuln/416779). Recommended compensating controls until the fix lands: restrict interactive/authenticated local access to hosts running PowerInfer, since exploitation requires an existing low-privileged local account (PR:L) plus a CUDA-capable GPU, so removing untrusted local users eliminates the practical attack path (trade-off: limits multi-tenant or shared development use); run the serving process under a dedicated least-privilege account in a container/cgroup with limited memory access so an over-read cannot expose other workloads' data and any crash is contained (trade-off: added deployment complexity); only load model weights and matrices from trusted, verified sources, since the trigger is a crafted/malformed striped FFN matrix fed to create_striped_mat_to_gpu (trade-off: none beyond provenance hygiene, but it does not protect against accidental corruption); and, where the GPU-split FFN loader is not required, disable GPU-split loading and fall back to CPU-only inference to avoid the vulnerable CUDA code path entirely (trade-off: significant performance loss, which for a low-severity local over-read is often acceptable). Monitor the PowerInfer repository and the vendor advisory for a merged upstream fix and rebase once an accepted commit or release is published.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PowerInfer is an LLM inference engine that offloads computation to GPUs; its ggml CUDA backend (ggml-cuda.cu) builds GPU-side buffers for feed-forward network layers during inference. The vulnerable routine create_striped_mat_to_gpu in the FFN GPU-split Loader performs an out-of-bounds read (CWE-125) - a memory-safety defect in the class of buffer over-read / information disclosure, likely caused by missing or incorrect bounds validation on the dimensions or layout of a striped matrix before copying/computing across the striped FFN weights. The root cause class (CWE-125) means data is read past the end of an allocated buffer, which can leak adjacent process memory into the compute path or simply crash the process; C, I and A impacts are all rated Low and there is no scope change or privilege escalation. The CPE cpe:2.3:a:tiiny-ai:powerinfer:*:*:*:*:*:*:*:* confirms PowerInfer as the affected product with a wildcard version, consistent with the project's rolling release scheme, so no discrete affected release can be enumerated. The attack surface is local only (AV:L) and the CUDA vector must be built and driven through the GPU-split FFN path for the bug to be reachable.
Know when Powerinfer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Local authenticated access to the GPU loader gives AV:L/PR:L/AC:L; an out-of-bounds read yields limited info disclosure (C:L) and possible crash (A:L) but no integrity impact (I:N).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Affected is the function create_striped_mat_to_gpu of the file smallthinker/ggml/src/ggml-cuda/ggml-cuda.cu of the component FFN GPU-split Loader. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The pull request to fix this issue awaits acceptance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB