Database/AI/ML frameworks & serving
PowerInfer: unvalidated data_offset in the GGUF parser causes an out-of-bounds read when loading a model
Impact
PowerInfer's GGUF loader uses the data_offset field from the model file without validating it, so a crafted GGUF reads outside the mapped buffer. The disclosed outcome is a crash or small information leak in the process loading the model, not host compromise. It matters on a serving node only where the model file is not fully under the operator's control - a tenant-supplied GGUF, or a checkpoint pulled from a public hub into a shared worker. An exploit is public. PowerInfer ships as a rolling release, so there are no version boundaries to reason about.
Who can reach it
Local - a user who can place a GGUF file where the PowerInfer process will load it, or who can submit a model to a loader running on the node. Requires low privileges on the host; not reachable over the network in the reported path.
What to do
No fix is available: the upstream pull request is still awaiting acceptance and the project's rolling release model means no fixed version exists to pin. Mitigate by loading only GGUF files from sources you control, keeping model directories unwritable by tenants, and running the loader unprivileged and isolated. Re-check the upstream issue for the merged bounds check.
References
Related entries
- PowerInfer: out-of-bounds read in the CUDA FFN GPU-split loader while staging weights to the deviceCVE-2026-108960 · PowerInfer CUDA FFN GPU-split loader (create_striped_mat_to_gpu)Low
- vLLM: malformed tiktoken vocab file crashes the tokenizer backend, denying service on the GPU nodeCVE-2026-90713 · vLLM (Rust tiktoken vocab file handler, TiktokenTokenizer::new)Low
- LangChain4j agentic: unsafe Jackson default typing in AgenticScope deserialization allows arbitrary class instantiationCVE-2026-97869 · LangChain4j agentic module (AgenticScopeSerializer JSON deserialization)Low
- Langchain-Chatchat: arbitrary file write outside the upload and knowledge-base directoriesCVE-2026-51882 · Langchain-Chatchat (file upload and knowledge-base endpoints, path traversal)Unscored
- llama.cpp: a crafted GGUF file trips a reachable assertion and aborts the process loading itCVE-2026-52131 · llama.cpp (gguf_reader::read GGUF model file parser)Unscored
- llama.cpp server: negative top_n on /rerank drives an unbounded allocation and denial of serviceCVE-2026-52132 · llama.cpp server /rerank endpoint (top_n handling under --reranking)Unscored
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.