{"id":"CVE-2026-122189","title":"OpenPPL ppl.nn CUDA Optimizer opt_graph.cc InitQuantization out-of-bounds","summary":"A vulnerability has been found in OpenPPL ppl.nn up to bb84dc9952809b3a5a0036858a3d9f68af1c83d5. The affected element is the function OptGraph::InitQuantization of the file src/ppl/nn/engines/cuda/optimizer/opt_graph.cc of the component …","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C","cvssSource":"cna","cwe":["CWE-125","CWE-119"],"vendor":"OpenPPL","product":"ppl.nn","affected":["ppl.nn bb84dc9952809b3a5a0036858a3d9f68af1c83d5"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T20:51:35.756999Z"},"exploitAvailable":true,"published":"2026-11-05","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:51:45.837Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-122189","references":[{"url":"https://vuldb.com/vuln/431163","label":"VDB-431163 | OpenPPL ppl.nn CUDA Optimizer opt_graph.cc InitQuantization out-of-bounds"},{"url":"https://vuldb.com/vuln/431163/cti","label":"VDB-431163 | CTI Indicators (IOB, IOC, IOA)"},{"url":"https://vuldb.com/cve/CVE-2026-122189","label":"CVE-2026-122189 | CVE Analysis and Report"},{"url":"https://vuldb.com/submit/1028313","label":"Submit #1028313 | OpenPPL ppl.nn commit bb84dc9952809b3a5a0036858a3d9f68af1c83d5 Out-of-bounds Read"},{"url":"https://github.com/OpenPPL/ppl.nn/issues/975"},{"url":"https://github.com/user-attachments/files/33393000/poc.zip"},{"url":"https://github.com/OpenPPL/ppl.nn/"}],"tags":["cve.org","exploit-available"],"epss":0.00242,"epssPercentile":0.15413,"ingestedAt":"2026-11-05T22:38:31.886Z","slug":"CVE-2026-122189","body":"## Overview\n\nA vulnerability has been found in OpenPPL ppl.nn up to bb84dc9952809b3a5a0036858a3d9f68af1c83d5. The affected element is the function OptGraph::InitQuantization of the file src/ppl/nn/engines/cuda/optimizer/opt_graph.cc of the component CUDA Optimizer. Such manipulation of the argument per_channel/bit_width/tensor_max/tensor_min/scale leads to out-of-bounds read. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.\n\n## Affected\n\n- `ppl.nn bb84dc9952809b3a5a0036858a3d9f68af1c83d5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}