{"id":"CVE-2026-122189","kind":"vulnerability","aliases":["CVE-2026-122189"],"related":[],"title":"OpenPPL ppl.nn: out-of-bounds read in CUDA quantization graph optimizer","description":"A vulnerability has been found in OpenPPL ppl.nn up to bb84dc9952809b3a5a0036858a3d9f68af1c83d5. The affected element is the function OptGraph::InitQuantization of the file src/ppl/nn/engines/cuda/optimizer/opt_graph.cc of the component CUDA Optimizer. Such manipulation of the argument per_channel/bit_width/tensor_max/tensor_min/scale leads to out-of-bounds read. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.","summary":"OpenPPL ppl.nn, a neural network inference library, has an out-of-bounds read in its CUDA optimizer's InitQuantization function when crafted quantization arguments are supplied. An attacker who can submit such input can read memory outside the intended buffer, which may leak data or crash the process.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ppl.nn","fixed":[],"affected":"up to commit bb84dc9952809b3a5a0036858a3d9f68af1c83d5 (CUDA engine); no versioned releases","ecosystem":"github"}],"ecosystems":[],"tags":["cuda","machine-learning","openppl","package","ppl-nn"],"not_affected_if":["no-cuda-engine","no-ppl-nn-usage"],"how_to_check":"ppl.nn has no releases for this; check whether your build includes src/ppl/nn/engines/cuda/optimizer/opt_graph.cc (CUDA engine) at or before commit bb84dc9952809b3a5a0036858a3d9f68af1c83d5 (git -C ppl.nn log --oneline | grep bb84dc9), and whether you load quantized models or quantization params from untrusted sources.","fix":"No fix known. The project (OpenPPL/ppl.nn, rolling release, no versions) has not responded to the issue report per VulDB. Avoid loading untrusted models/quantization params with the CUDA engine, or pin and patch bounds checks in OptGraph::InitQuantization yourself.","status":"open","published_at":"2026-11-05T03:17:21+00:00","first_seen_at":"2026-11-05T03:31:40+00:00","triaged_at":"2026-11-05T03:33:25+00:00","updated_at":"2026-11-05T03:34:20+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T03:33:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"OpenPPL ppl.nn: out-of-bounds read in CUDA quantization graph optimizer","impact":"medium","summary":"OpenPPL ppl.nn, a neural network inference library, has an out-of-bounds read in its CUDA optimizer's InitQuantization function when crafted quantization arguments are supplied. An attacker who can submit such input can read memory outside the intended buffer, which may leak data or crash the process.","audience":"developers","category":"package","nicknames":[],"who_cares":["openppl","ppl-nn","cuda","machine-learning"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Out-of-bounds memory read may leak data or crash the process","analyst_note":"Check the NVD entry and the upstream OpenPPL repository for any response, fixed commit, or affected version range, and confirm whether the exploit is public.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-ppl-nn-usage","no-cuda-engine"],"who_is_affected":"Teams that build or run OpenPPL ppl.nn with the CUDA engine and feed it quantized models or graph inputs from untrusted sources are the ones exposed. The sources say the product has no versioning and the project has not yet responded, so no affected or unaffected release range is known. Teams that do not use ppl.nn or its CUDA optimizer can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000717,"input_tokens":4383,"output_tokens":558,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the upstream OpenPPL repository for any response, fixed commit, or affected version range, and confirm whether the exploit is public.","search":"'-122189':15A,18A '-2026':14A,17A 'affect':90C,149C 'argument':53B,110C 'attack':57B,121C 'bb84dc9952809b3a5a0036858a3d9f68af1c83d5':88C 'bound':6A,41B,118C 'buffer':69B 'channel/bit_width/tensor_max/tensor_min/scale':112C 'compon':103C 'craft':51B 'crash':75B 'cuda':9A,20B,45B,104C 'cve':13A,16A 'data':73B 'disclos':130C 'earli':162C 'element':91C 'exploit':127C 'file':99C 'found':82C 'function':49B,94C 'graph':11A 'infer':34B 'inform':147C,158C 'initquant':48B,96C 'input':62B 'intend':68B 'issu':165C 'launch':124C 'lead':113C 'leak':72B 'learn':23B 'librari':35B 'machin':22B 'machine-learn':21B 'manipul':107C 'may':71B,135C 'memori':65B 'network':33B 'neural':32B 'nn':28B 'openppl':1A,24B,29B,84C 'optgraph':95C 'optim':12A,46B,105C 'out-of-bound':3A,38B,115C 'outsid':66B 'packag':25B 'per':111C 'ppl':27B 'ppl-nn':26B 'ppl.nn':2A,19A,30B,85C 'problem':161C 'process':77B 'product':139C 'project':156C 'public':133C 'quantiz':10A,52B 'read':7A,42B,64B,119C 'releas':152C 'remot':125C 'report':166C 'respond':170C 'src/ppl/nn/engines/cuda/optimizer/opt_graph.cc':100C 'submit':60B 'suppli':55B 'unaffect':151C 'unavail':154C 'use':137C,142C 'version':143C 'vulner':79C 'yet':171C","nicknames":[],"mitigations":[],"who_affected":"Teams that build or run OpenPPL ppl.nn with the CUDA engine and feed it quantized models or graph inputs from untrusted sources are the ones exposed. The sources say the product has no versioning and the project has not yet responded, so no affected or unaffected release range is known. Teams that do not use ppl.nn or its CUDA optimizer can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":["pplnn"],"ptokens":["nn","ppl"],"labels":["cuda","high","machinelearning","openppl","package","pplnn"],"campaign_type":null,"first_public_at":"2026-11-05T03:17:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122189","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122189","severity":null,"published_at":"2026-11-05T03:17:21+00:00","modified_at":"2026-11-05T03:17:21+00:00","first_seen_at":"2026-11-05T03:31:40+00:00","fetched_at":"2026-11-05T03:31:40+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-122189:1749","url":"https://vuldb.com/vuln/431163","severity":null,"published_at":"2026-11-05T03:34:20+00:00","modified_at":"2026-11-05T03:34:20+00:00","first_seen_at":"2026-11-05T03:34:20+00:00","fetched_at":"2026-11-05T03:34:20+00:00","note":"Per VulDB (VDB-431163), CWE-125 in OptGraph::InitQuantization; a public PoC is reported on GitHub but I could not find the issue/PoC link (VulDB hides it), so poc_count not set and exploitation in the wild is not reported. Maintainers have not responded; no fix or version range. Could not reach the NVD page via web-cli. Nothing verified: no vendor primary page found. Note: VulDB says user interaction is required (UI:P), so 'remote' means a crafted model/input must be loaded.","cites":["https://vuldb.com/vuln/431163"]}],"documents":[{"id":72853,"url":"https://vuldb.com/vuln/431163","title":"VulDB VDB-431163: OpenPPL ppl.nn InitQuantization out-of-bounds","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}