CVE-2026-108960: Tiiny-AI PowerInfer FFN GPU-split Loader ggml-cuda.cu create_striped_mat_to_gpu out-of-bounds
A vulnerability was detected in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Affected is the function createstripedmattogpu of the file smallthinker/ggml/src/ggml-cuda/ggml-cuda.cu of the component FFN GPU-split Loader. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The pull request to fix this issue awaits acceptance.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
Exploitation must be approached locally. The severity vector indicates that the attacker also needs low privileges; no user interaction is required.
Is exploit code available?
Yes. The exploit is public and may be used.
How can I determine whether my deployment is affected or fixed?
PowerInfer revisions up to commit 8bd56d69906c9d2dba4d3bf6899763401e01a9a4 are affected. Because the project uses rolling releases, affected and updated release version numbers are not disclosed; the referenced fix pull request was still awaiting acceptance.