---
id: CVE-2026-108960
title: >-
  A vulnerability was detected in Tiiny-AI PowerInfer up to
  8bd56d69906c9d2dba4d3bf6899763401e01a9a4
summary: >-
  A vulnerability was detected in Tiiny-AI PowerInfer up to
  8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Affected is the function
  create_striped_mat_to_gpu of the file
  smallthinker/ggml/src/ggml-cuda/ggml-cuda.cu of the component FFN GPU-spli…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-119
  - CWE-125
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T03:16:40.760'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-108960'
references:
  - url: 'https://github.com/Tiiny-AI/PowerInfer/'
    label: cna@vuldb.com
  - url: 'https://github.com/Tiiny-AI/PowerInfer/issues/284'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/cve/CVE-2026-108960'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/997933'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/416779'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/416779/cti'
    label: cna@vuldb.com
tags:
  - nvd
ingestedAt: '2026-10-13T04:14:33.875Z'
---

## Overview

A vulnerability was detected in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Affected is the function create_striped_mat_to_gpu of the file smallthinker/ggml/src/ggml-cuda/ggml-cuda.cu of the component FFN GPU-split Loader. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The pull request to fix this issue awaits acceptance.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.