CVE-2026-122189

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-122189", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-11-04T19:08:58.956Z", "datePublished": "2026-11-05T03:00:48.902Z", "dateUpdated": "2026-11-05T20:51:45.837Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-11-05T03:00:48.902Z"}, "title": "OpenPPL ppl.nn CUDA Optimizer opt_graph.cc InitQuantization out-of-bounds", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-125", "lang": "en", "description": "Out-of-Bounds Read"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-119", "lang": "en", "description": "Memory Corruption"}]}], "affected": [{"vendor": "OpenPPL", "product": "ppl.nn", "versions": [{"version": "bb84dc9952809b3a5a0036858a3d9f68af1c83d5", "status": "affected"}], "cpes": ["cpe:2.3:a:openppl:ppl.nn:*:*:*:*:*:*:*:*"], "modules": ["CUDA Optimizer"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in OpenPPL ppl.nn up to bb84dc9952809b3a5a0036858a3d9f68af1c83d5. The affected element is the function OptGraph::InitQuantization of the file src/ppl/nn/engines/cuda/optimizer/opt_graph.cc of the component CUDA Optimizer. Such manipulation of the argument per_channel/bit_width/tensor_max/tensor_min/scale leads to out-of-bounds read. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}], "timeline": [{"time": "2026-11-04T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-11-04T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-11-04T20:14:03.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Dem000000 (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/431163", "name": "VDB-431163 | OpenPPL ppl.nn CUDA Optimizer opt_graph.cc InitQuantization out-of-bounds", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/431163/cti", "name": "VDB-431163 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-122189", "name": "CVE-2026-122189 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/1028313", "name": "Submit #1028313 | OpenPPL ppl.nn commit bb84dc9952809b3a5a0036858a3d9f68af1c83d5 Out-of-bounds Read", "tags": ["third-party-advisory"]}, {"url": "https://github.com/OpenPPL/ppl.nn/issues/975", "tags": ["issue-tracking"]}, {"url": "https://github.com/user-attachments/files/33393000/poc.zip", "tags": ["exploit"]}, {"url": "https://github.com/OpenPPL/ppl.nn/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202611"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T20:51:35.756999Z", "id": "CVE-2026-122189", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T20:51:45.837Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-122189", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T20:51:35.756999Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T20:51:41.271Z"}}], "cna": {"title": "OpenPPL ppl.nn CUDA Optimizer opt_graph.cc InitQuantization out-of-bounds", "credits": [{"lang": "en", "type": "reporter", "value": "Dem000000 (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:openppl:ppl.nn:*:*:*:*:*:*:*:*"], "vendor": "OpenPPL", "modules": ["CUDA Optimizer"], "product": "ppl.nn", "versions": [{"status": "affected", "version": "bb84dc9952809b3a5a0036858a3d9f68af1c83d5"}]}], "timeline": [{"lang": "en", "time": "2026-11-04T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-11-04T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-11-04T20:14:03.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/431163", "name": "VDB-431163 | OpenPPL ppl.nn CUDA Optimizer opt_graph.cc InitQuantization out-of-bounds", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/431163/cti", "name": "VDB-431163 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-122189", "name": "CVE-2026-122189 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/1028313", "name": "Submit #1028313 | OpenPPL ppl.nn commit bb84dc9952809b3a5a0036858a3d9f68af1c83d5 Out-of-bounds Read", "tags": ["third-party-advisory"]}, {"url": "https://github.com/OpenPPL/ppl.nn/issues/975", "tags": ["issue-tracking"]}, {"url": "https://github.com/user-attachments/files/33393000/poc.zip", "tags": ["exploit"]}, {"url": "https://github.com/OpenPPL/ppl.nn/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202611"], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in OpenPPL ppl.nn up to bb84dc9952809b3a5a0036858a3d9f68af1c83d5. The affected element is the function OptGraph::InitQuantization of the file src/ppl/nn/engines/cuda/optimizer/opt_graph.cc of the component CUDA Optimizer. Such manipulation of the argument per_channel/bit_width/tensor_max/tensor_min/scale leads to out-of-bounds read. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "Out-of-Bounds Read"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "Memory Corruption"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-11-05T03:00:48.902Z"}}}, "cveMetadata": {"cveId": "CVE-2026-122189", "state": "PUBLISHED", "dateUpdated": "2026-11-05T20:51:45.837Z", "dateReserved": "2026-11-04T19:08:58.956Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-11-05T03:00:48.902Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:openppl:ppl.nn:*:*:*:*:*:*:*:*"], "modules": ["CUDA Optimizer"], "product": "ppl.nn", "vendor": "OpenPPL", "versions": [{"status": "affected", "version": "bb84dc9952809b3a5a0036858a3d9f68af1c83d5"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in OpenPPL ppl.nn up to bb84dc9952809b3a5a0036858a3d9f68af1c83d5. The affected element is the function OptGraph::InitQuantization of the file src/ppl/nn/engines/cuda/optimizer/opt_graph.cc of the component CUDA Optimizer. Such manipulation of the argument per_channel/bit_width/tensor_max/tensor_min/scale leads to out-of-bounds read. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet."}], "id": "CVE-2026-122189", "lastModified": "2026-11-05T21:18:44.140", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-122189", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T20:51:35.756999Z", "version": "2.0.3"}}]}, "published": "2026-11-05T03:17:21.577", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/OpenPPL/ppl.nn/"}, {"source": "cna@vuldb.com", "url": "https://github.com/OpenPPL/ppl.nn/issues/975"}, {"source": "cna@vuldb.com", "url": "https://github.com/user-attachments/files/33393000/poc.zip"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-122189"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/1028313"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/431163"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/431163/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-125"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{"bugzilla": {"description": "ppl.nn: ppl.nn: Denial of Service via out-of-bounds read in CUDA optimizer", "id": "2567652", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567652"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A vulnerability has been found in OpenPPL ppl.nn up to bb84dc9952809b3a5a0036858a3d9f68af1c83d5. The affected element is the function OptGraph::InitQuantization of the file src/ppl/nn/engines/cuda/optimizer/opt_graph.cc of the component CUDA Optimizer. Such manipulation of the argument per_channel/bit_width/tensor_max/tensor_min/scale leads to out-of-bounds read. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.", "A flaw was found in ppl.nn. An out-of-bounds read vulnerability in the CUDA optimizer allows a remote attacker to cause a Denial of Service (DoS) or disclose sensitive memory contents by providing manipulated quantization parameters. When the application processes crafted inputs during quantization initialization, it reads memory beyond allocated buffer boundaries, leading to an application crash or unauthorized data disclosure."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-122189", "public_date": "2026-11-05T03:00:48Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-122189\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-122189\nhttps://github.com/OpenPPL/ppl.nn/\nhttps://github.com/OpenPPL/ppl.nn/issues/975\nhttps://github.com/user-attachments/files/33393000/poc.zip\nhttps://vuldb.com/cve/CVE-2026-122189\nhttps://vuldb.com/submit/1028313\nhttps://vuldb.com/vuln/431163\nhttps://vuldb.com/vuln/431163/cti"], "statement": "This vulnerability is rated as having Moderate impact by Red Hat because exploitation depends on processing crafted neural network configurations and is limited to causing an application crash or sensitive memory disclosure without arbitrary code execution. The ppl.nn inference library is not shipped or supported in Red Hat Enterprise Linux or any other Red Hat product offerings. Standard enterprise deployments are therefore not exposed unless custom third-party applications specifically bundle and run this component.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "bb84dc9952809b3a5a0036858a3d9f68af1c83d5"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "ppl.nn", "source": "cna", "vendor": "OpenPPL"}, "product": "ppl.nn", "vendor": "openppl"}], "created": "2026-11-05T05:00:14.178739+00:00", "updated": "2026-11-06T21:15:32.668992+00:00", "vendors": ["openppl", "openppl$PRODUCT$ppl.nn"]}