PPL.NN · CVE-2026-122189 · Package
NO FIX YET · SEE WHAT TO DO
OpenPPL ppl.nn, a neural network inference library, has an out-of-bounds read in its CUDA optimizer's InitQuantization function when crafted quantization arguments are supplied. An attacker who can submit such input can read memory outside the intended buffer, which may leak data or crash the process.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that build or run OpenPPL ppl.nn with the CUDA engine and feed it quantized models or graph inputs from untrusted sources are the ones exposed. The sources say the product has no versioning and the project has not yet responded, so no affected or unaffected release range is known. Teams that do not use ppl.nn or its CUDA optimizer can skip it.
Not affected if no-cuda-engine, no-ppl-nn-usage
Who cares cuda, machine-learning, openppl, ppl-nn
ppl.nn has no releases for this; check whether your build includes src/ppl/nn/engines/cuda/optimizer/opt_graph.cc (CUDA engine) at or before commit bb84dc9952809b3a5a0036858a3d9f68af1c83d5 (git -C ppl.nn log --oneline | grep bb84dc9), and whether you load quantized models or quantization params from untrusted sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
A vulnerability has been found in OpenPPL ppl.nn up to bb84dc9952809b3a5a0036858a3d9f68af1c83d5. The affected element is the function OptGraph::InitQuantization of the file src/ppl/nn/engines/cuda/optimizer/opt_graph.cc of the component CUDA Optimizer. Such manipulation of the argument per_channel/bit_width/tensor_max/tensor_min/scale leads to out-of-bounds read. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.