Database/AI/ML frameworks & serving
PowerInfer: out-of-bounds read in the CUDA FFN GPU-split loader while staging weights to the device
Impact
create_striped_mat_to_gpu in PowerInfer's CUDA backend reads out of bounds while striping feed-forward weights onto the GPU, a separate code path from the GGUF header parsing issue and in the device-side loader rather than the file parser. Reported impact is limited to a read overrun during model load - a crash or small leak in the worker holding the CUDA context, with no privilege gain claimed. It is relevant only where the model being loaded is not fully operator-controlled. An exploit is public, and the project's rolling release model means no affected or fixed version numbers are published.
Who can reach it
Local - a user able to get a model loaded by the PowerInfer CUDA backend on the GPU node. Requires low privileges on the host; no network path reported.
What to do
No fix yet: the upstream pull request is awaiting acceptance, and with a rolling release there is no version to pin to. Mitigate by restricting which models the GPU worker may load and keeping model storage unwritable by tenants. Note this needs a separate fix from the GGUF parser issue (CVE-2026-108955) - they are different files and different code paths.
References
Related entries
- vLLM: malformed tiktoken vocab file crashes the tokenizer backend, denying service on the GPU nodeCVE-2026-90713 · vLLM (Rust tiktoken vocab file handler, TiktokenTokenizer::new)Low
- LangChain4j agentic: unsafe Jackson default typing in AgenticScope deserialization allows arbitrary class instantiationCVE-2026-97869 · LangChain4j agentic module (AgenticScopeSerializer JSON deserialization)Low
- Langchain-Chatchat: arbitrary file write outside the upload and knowledge-base directoriesCVE-2026-51882 · Langchain-Chatchat (file upload and knowledge-base endpoints, path traversal)Unscored
- llama.cpp: a crafted GGUF file trips a reachable assertion and aborts the process loading itCVE-2026-52131 · llama.cpp (gguf_reader::read GGUF model file parser)Unscored
- llama.cpp server: negative top_n on /rerank drives an unbounded allocation and denial of serviceCVE-2026-52132 · llama.cpp server /rerank endpoint (top_n handling under --reranking)Unscored
- Hugging Face Transformers: load_custom_generate writes remote code to disk before the trust checkCVE-2026-80047 · Hugging Face Transformers (dynamic_module_utils.py, load_custom_generate remote-code cache)Unscored
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.