Description
A flaw has been found in turboderp-org ExLlamaV2 up to 0.3.2. The impacted element is the function QMatrix::make_sequential of the file exllamav2/exllamav2_ext/cuda/q_matrix.cu of the component GPTQ Index Handler. Executing a manipulation of the argument g_idx can lead to out-of-bounds write. The attack needs to be launched locally. The project was informed of the problem early through an issue report but has not responded yet.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| turboderp-org | ExLlamaV2 | 0.3.0, 0.3.1, 0.3.2 | — |
References
- VDB-426401 | turboderp-org ExLlamaV2 GPTQ Index q_matrix.cu make_sequential out-of-bounds write vdb-entry technical-description
- VDB-426401 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-116502 | CVE Analysis and Report third-party-advisory
- Submit #1022425 | turboderp-org / ExLlamaV2 exllamav2 0.0.4 - 0.3.2 Heap out-of-bounds write caused by an unvalidated GPTQ `g_idx` v third-party-advisory
- https://github.com/turboderp-org/exllamav2/issues/817 issue-tracking
- https://github.com/turboderp-org/exllamav2/ product