{"id":"CVE-2026-108955","published":"2026-10-13T02:16:57.690","lastModified":"2026-10-15T16:17:41.780","description":"A vulnerability was determined in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Impacted is the function gguf_init_from_file of the file ggml.c of the component GGUF Parser. This manipulation of the argument data_offset causes out-of-bounds read. The attack requires local access. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The pull request to fix this issue awaits acceptance.","cvssScore":5.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","cwes":["CWE-119","CWE-125"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Tiiny-AI/PowerInfer/","tags":[]},{"url":"https://github.com/Tiiny-AI/PowerInfer/issues/283","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-108955","tags":[]},{"url":"https://vuldb.com/submit/997844","tags":[]},{"url":"https://vuldb.com/vuln/416774","tags":[]},{"url":"https://vuldb.com/vuln/416774/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/Tiiny-AI/PowerInfer/","tags":[]},{"url":"https://github.com/Tiiny-AI/PowerInfer/issues/283","tags":[]}],"hasPoc":true,"ai":null}