Search

Find a vulnerability

Search criteria

    2 vulnerabilities by Turboderp-org

    CVE-2026-84286 (GCVE-0-2026-84286)

    Vulnerability from nvd – Published: 2026-10-12 17:01 – Updated: 2026-10-12 17:14
    VLAI
    Title
    OOB Read/Write via Negative Array Index in exllamav3_ext Kernel Table
    Summary
    ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds. A malicious model can force the code to read and invoke an out‑of‑range function pointer, resulting in a reproducible crash. Under specific conditions involving certain host memory layouts, it may be possible for an attacker to exploit this vulnerability to achieve controlled indirect kernel dispatch during model load.
    Severity
    No CVSS data available.
    CWE
    Assigner
    certcc CNA under the mitre root
    CNA scorecard E 42/100 over 153 records in the last 180 days details
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-10-12T17:14:02.436Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://www.kb.cert.org/vuls/id/369611"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ExLlamaV3",
          "vendor": "Turboderp-org",
          "versions": [
            {
              "status": "affected",
              "version": "3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ExLlamaV3\u2019s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds. A malicious model can force the code to read and invoke an out\u2011of\u2011range function pointer, resulting in a reproducible crash. Under specific conditions involving certain host memory layouts, it may be possible for an attacker to exploit this vulnerability to achieve controlled indirect kernel dispatch during model load."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-125 Out-of-bounds Read",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-787 Out-of-bounds Write",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-20 Improper Input Validation",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T17:06:12.603Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://kb.cert.org/vuls/id/369611"
        },
        {
          "url": "https://github.com/turboderp-org/exllamav3/pull/310"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "OOB Read/Write via Negative Array Index in exllamav3_ext Kernel Table",
      "x_generator": {
        "engine": "VINCE 3.0.50",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-84286"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-84286",
    "datePublished": "2026-10-12T17:01:16.032Z",
    "dateReserved": "2026-09-01T15:47:57.172Z",
    "dateUpdated": "2026-10-12T17:14:02.436Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-84286 (GCVE-0-2026-84286)

    Vulnerability from cvelistv5 – Published: 2026-10-12 17:01 – Updated: 2026-10-12 17:14
    VLAI
    Title
    OOB Read/Write via Negative Array Index in exllamav3_ext Kernel Table
    Summary
    ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds. A malicious model can force the code to read and invoke an out‑of‑range function pointer, resulting in a reproducible crash. Under specific conditions involving certain host memory layouts, it may be possible for an attacker to exploit this vulnerability to achieve controlled indirect kernel dispatch during model load.
    Severity
    No CVSS data available.
    CWE
    Assigner
    certcc CNA under the mitre root
    CNA scorecard E 42/100 over 153 records in the last 180 days details
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-10-12T17:14:02.436Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://www.kb.cert.org/vuls/id/369611"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ExLlamaV3",
          "vendor": "Turboderp-org",
          "versions": [
            {
              "status": "affected",
              "version": "3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ExLlamaV3\u2019s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds. A malicious model can force the code to read and invoke an out\u2011of\u2011range function pointer, resulting in a reproducible crash. Under specific conditions involving certain host memory layouts, it may be possible for an attacker to exploit this vulnerability to achieve controlled indirect kernel dispatch during model load."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-125 Out-of-bounds Read",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-787 Out-of-bounds Write",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-20 Improper Input Validation",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T17:06:12.603Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://kb.cert.org/vuls/id/369611"
        },
        {
          "url": "https://github.com/turboderp-org/exllamav3/pull/310"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "OOB Read/Write via Negative Array Index in exllamav3_ext Kernel Table",
      "x_generator": {
        "engine": "VINCE 3.0.50",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-84286"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-84286",
    "datePublished": "2026-10-12T17:01:16.032Z",
    "dateReserved": "2026-09-01T15:47:57.172Z",
    "dateUpdated": "2026-10-12T17:14:02.436Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}