Out-of-Bounds Read Vulnerability in Tiiny-AI PowerInfer GGUF Parser
CVE-2026-108955

4.8MEDIUM

Key Information:

Vendor

Tiiny-ai

Status
Powerinfer
Vendor
CVE Published:
13 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-108955?

A vulnerability exists in Tiiny-AI PowerInfer, particularly in the GGUF Parser component's gguf_init_from_file function. This flaw results from improper handling of the data_offset argument, which can lead to an out-of-bounds read scenario. Attackers with local access could potentially exploit this vulnerability. Although specific version details are sparse due to the rolling release model employed by Tiiny-AI, it is crucial for users to remain vigilant as the exploit has been publicly disclosed. Fixes are currently in review and awaiting acceptance.

Affected Version(s)

PowerInfer 8bd56d69906c9d2dba4d3bf6899763401e01a9a4

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-108955 - Proof of Concept

References

https://vuldb.com/vuln/416774
vdb-entrytechnical-description
https://vuldb.com/vuln/416774/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-108955
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

dem0000 (VulDB User)
VulDB CNA Team
.