CVE-2026-108955: Out-of-Bounds Read in Tiiny-AI PowerInfer

This vulnerability in Tiiny-AI PowerInfer affects the GGUF Parser's gguf_init_from_file function in the ggml.c file. Manipulation of the data_offset argument can trigger an out-of-bounds read, potentially exposing memory contents or causing application instability. Exploitation requires local privileges and no user interaction is needed. The issue has been publicly disclosed, and a fix has been proposed but not yet merged. Due to the rolling release model of the product, exact affected versions are not specified.

The vulnerability allows a local attacker to cause an out-of-bounds read, which may lead to information disclosure or application crashes. The CVSS score of 4.8 (medium severity) reflects limited impact due to the requirement for local access and low complexity of attack. There is no indication of remote exploitation or privilege escalation from the provided data.

No official patch or fix has been released yet; the proposed fix is pending acceptance. Users should monitor the vendor's repository or advisory channels for the acceptance and deployment of the fix. Since the product uses a rolling release model, updating to the latest version after the fix is merged will likely remediate the issue. Until then, restrict local access to trusted users only.