Filtered by vendor Turboderp-org Subscriptions
Filtered by product Exllamav3 Subscriptions
Total 1 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-84286 1 Turboderp-org 1 Exllamav3 2026-10-19 9.8 Critical
ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds. A malicious model can force the code to read and invoke an out‑of‑range function pointer, resulting in a reproducible crash. Under specific conditions involving certain host memory layouts, it may be possible for an attacker to exploit this vulnerability to achieve controlled indirect kernel dispatch during model load.