Powerinfer
Monthly
An out-of-bounds read in Tiiny-AI PowerInfer's CUDA backend lets a local, authenticated user crash or partially disclose memory by supplying a crafted model or matrix input to the FFN GPU-split loader path (create_striped_mat_to_gpu in smallthinker/ggml/src/ggml-cuda/ggml-cuda.cu). Exploitation requires an existing low-privileged local account and a CUDA-capable deployment that actually exercises the GPU-split FFN loading path; there is no remote vector and impact is confined to the local process (CWE-125, CVSS 4.0 base 1.9, assessed 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L). Publicly available exploit code exists (referenced via the project's GitHub issue tracker), but there is no confirmed active exploitation (no CISA KEV listing), and the overall risk is low. PowerInfer uses a rolling release model, so no affected or fixed version numbers are disclosed, and the proposed fix pull request awaits acceptance.
An out-of-bounds read in the GGUF model parser of Tiiny-AI PowerInfer (gguf_init_from_file in ggml.c) lets a local attacker who can supply a crafted GGUF file trigger the parser to read past the end of a buffer via a manipulated data_offset value, resulting in memory disclosure or a crash rather than code execution. Only local users with low privileges (CVSS PR:L, AV:L, no user interaction) are able to reach the vulnerable code path, and the attacker must control or substitute the model file that PowerInfer loads; the issue is rated only 1.9 under CVSS 4.0, and our independent assessment aligns with a Low/C:L/I:N/A:L profile on CVSS 3.1. Publicly available exploit code exists (the reported issue includes a proof-of-concept), but there is no confirmed active exploitation (not listed in CISA KEV), and no accepted upstream patch - a pull request addressing the flaw is still awaiting acceptance.
An out-of-bounds read in Tiiny-AI PowerInfer's CUDA backend lets a local, authenticated user crash or partially disclose memory by supplying a crafted model or matrix input to the FFN GPU-split loader path (create_striped_mat_to_gpu in smallthinker/ggml/src/ggml-cuda/ggml-cuda.cu). Exploitation requires an existing low-privileged local account and a CUDA-capable deployment that actually exercises the GPU-split FFN loading path; there is no remote vector and impact is confined to the local process (CWE-125, CVSS 4.0 base 1.9, assessed 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L). Publicly available exploit code exists (referenced via the project's GitHub issue tracker), but there is no confirmed active exploitation (no CISA KEV listing), and the overall risk is low. PowerInfer uses a rolling release model, so no affected or fixed version numbers are disclosed, and the proposed fix pull request awaits acceptance.
An out-of-bounds read in the GGUF model parser of Tiiny-AI PowerInfer (gguf_init_from_file in ggml.c) lets a local attacker who can supply a crafted GGUF file trigger the parser to read past the end of a buffer via a manipulated data_offset value, resulting in memory disclosure or a crash rather than code execution. Only local users with low privileges (CVSS PR:L, AV:L, no user interaction) are able to reach the vulnerable code path, and the attacker must control or substitute the model file that PowerInfer loads; the issue is rated only 1.9 under CVSS 4.0, and our independent assessment aligns with a Low/C:L/I:N/A:L profile on CVSS 3.1. Publicly available exploit code exists (the reported issue includes a proof-of-concept), but there is no confirmed active exploitation (not listed in CISA KEV), and no accepted upstream patch - a pull request addressing the flaw is still awaiting acceptance.