CVE-2026-108955

A vulnerability was determined in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Impacted is the function gguf_init_from_file of the file ggml.c of the component GGUF Parser. This manipulation of the argument data_offset causes out-of-bounds read. The attack requires local access. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The pull request to fix this issue awaits acceptance.

• CWE-119
• CWE-125

• https://github.com/Tiiny-AI/PowerInfer/
• https://github.com/Tiiny-AI/PowerInfer/issues/283
• https://vuldb.com/cve/CVE-2026-108955
• https://vuldb.com/submit/997844
• https://vuldb.com/vuln/416774
• https://vuldb.com/vuln/416774/cti

Published

Oct 13, 2026

Last Modified

Oct 13, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10895Use after free in Ozone in Google Chrome prior to 149.0.7827…8.8
• CVE-2026-108950Open Source Social Network (OSSN) through 10.1 contains a mi…5.3
• CVE-2026-108951LavaLite CMS through 10.1.2 contains an authorization bypass…6.5
• CVE-2026-108952RT-Thread through 5.3.0 contains a memory corruption vulnera…4.6
• CVE-2026-108953mac-shell-mcp before 2.0.0 contains an OS command injection …7.8
• CVE-2026-108954A vulnerability was found in k2-fsa sherpa-onnx up to 1.13.8…6.3
• CVE-2026-108956A vulnerability was identified in code-projects Online Revie…7.3
• CVE-2026-108957A security flaw has been discovered in TinyLLaVA TinyLLaVA_F…6.3
• CVE-2026-108958A weakness has been identified in TensorLayer up to 2.2.4. T…6.3
• CVE-2026-108959A security vulnerability has been detected in itsourcecode O…6.3
• CVE-2026-10896Use after free in Chrome for iOS in Google Chrome on iOS pri…8.8
• CVE-2026-108960A vulnerability was detected in Tiiny-AI PowerInfer up to 8b…5.3