---
id: "CVE-2026-122189"
kind: "vulnerability"
aliases: ["CVE-2026-122189"]
title: "OpenPPL ppl.nn: out-of-bounds read in CUDA quantization graph optimizer"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "ppl.nn", "fixed": [], "affected": "up to commit bb84dc9952809b3a5a0036858a3d9f68af1c83d5 (CUDA engine); no versioned releases", "ecosystem": "github"}]
ecosystems: []
tags: ["cuda", "machine-learning", "openppl", "package", "ppl-nn"]
not_affected_if: ["no-cuda-engine", "no-ppl-nn-usage"]
published_at: "2026-11-05T03:17:21+00:00"
first_seen_at: "2026-11-05T03:31:40+00:00"
updated_at: "2026-11-05T03:34:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122189", "first_seen_at": "2026-11-05T03:31:40+00:00"}, {"source": "analyst", "url": "https://vuldb.com/vuln/431163", "first_seen_at": "2026-11-05T03:34:20+00:00", "cites": ["https://vuldb.com/vuln/431163"]}]
exploit_sources: []
---

# OpenPPL ppl.nn: out-of-bounds read in CUDA quantization graph optimizer

OpenPPL ppl.nn, a neural network inference library, has an out-of-bounds read in its CUDA optimizer's InitQuantization function when crafted quantization arguments are supplied. An attacker who can submit such input can read memory outside the intended buffer, which may leak data or crash the process.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:ppl.nn affected up to commit bb84dc9952809b3a5a0036858a3d9f68af1c83d5 (CUDA engine); no versioned releases fixed no fixed version listed

## How to check

ppl.nn has no releases for this; check whether your build includes src/ppl/nn/engines/cuda/optimizer/opt_graph.cc (CUDA engine) at or before commit bb84dc9952809b3a5a0036858a3d9f68af1c83d5 (git -C ppl.nn log --oneline | grep bb84dc9), and whether you load quantized models or quantization params from untrusted sources.

## Fix

No fix known. The project (OpenPPL/ppl.nn, rolling release, no versions) has not responded to the issue report per VulDB. Avoid loading untrusted models/quantization params with the CUDA engine, or pin and patch bounds checks in OptGraph::InitQuantization yourself.

## Timeline

- 2026-11-05T03:31:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122189
- 2026-11-05T03:34:20+00:00 analyst https://vuldb.com/vuln/431163 — Per VulDB (VDB-431163), CWE-125 in OptGraph::InitQuantization; a public PoC is reported on GitHub but I could not find the issue/PoC link (VulDB hides it), so poc_count not set and exploitation in the wild is not reported. Maintainers have not responded; no fix or version range. Could not reach the NVD page via web-cli. Nothing verified: no vendor primary page found. Note: VulDB says user interaction is required (UI:P), so 'remote' means a crafted model/input must be loaded.

## Documents

- [describes] VulDB VDB-431163: OpenPPL ppl.nn InitQuantization out-of-bounds https://vuldb.com/vuln/431163

## From the sources

A vulnerability has been found in OpenPPL ppl.nn up to bb84dc9952809b3a5a0036858a3d9f68af1c83d5. The affected element is the function OptGraph::InitQuantization of the file src/ppl/nn/engines/cuda/optimizer/opt_graph.cc of the component CUDA Optimizer. Such manipulation of the argument per_channel/bit_width/tensor_max/tensor_min/scale leads to out-of-bounds read. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_