CVE-2026-122189: OpenPPL ppl.nn CUDA Optimizer opt_graph.cc InitQuantization out-of-bounds
A vulnerability has been found in OpenPPL ppl.nn up to bb84dc9952809b3a5a0036858a3d9f68af1c83d5. The affected element is the function OptGraph::InitQuantization of the file src/ppl/nn/engines/cuda/optimizer/optgraph.cc of the component CUDA Optimizer. Such manipulation of the argument perchannel/bitwidth/tensormax/tensormin/scale leads to out-of-bounds read. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Event History
Frequently Asked Questions
Does exploitation require authentication or local access?
No privileges are required, and the attack can be launched remotely. However, user interaction is required according to the supplied CVSS vector.
Is public exploit information available?
Yes. The vulnerability is flagged as having a proof of concept, and the exploit has been publicly disclosed.
How can I determine whether my OpenPPL ppl.nn source is affected?
The project does not use versioned releases, so affected and unaffected release information is unavailable. The reported affected range extends through commit bb84dc9952809b3a5a0036858a3d9f68af1c83d5; compare your source history against that commit and inspect the CUDA Optimizer implementation.