EUVD-2026-72303
GHSA-4jpr-qjj4-9r96
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Checkpoint delivered over network with no auth required, but user must actively load it (UI:R); OOB read yields limited adjacent memory exposure (C:L) and possible crash (A:L) with no integrity impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability has been found in ModelCloud GPTQModel up to 7.2.0. This vulnerability affects unknown code of the file gptqmodel/nn_modules/qlinear/tritonv2.py of the component Triton dequantization kernel. Such manipulation of the argument g_idx leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.3.0 is able to resolve this issue. The name of the patch is 877c732f7d7dccd56a729844c6a5bd20f3aa8bb1. Upgrading the affected component is recommended.
AnalysisAI
Out-of-bounds read in ModelCloud GPTQModel ≤7.2.0 allows an attacker who controls a GPTQ checkpoint file to trigger unauthorized GPU device memory reads during model inference. The Triton dequantization kernel in tritonv2.py indexes scales/qzeros buffers using the checkpoint-supplied g_idx tensor without any upper-bound guard, so a crafted entry ≥ num_groups reads past the allocated buffer on the device. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all three of the following: (1) the target runs GPTQModel ≤7.2.0 specifically using the TritonV2 backend - the default PyTorch backend is not vulnerable because its tensor gather already faults on out-of-range indices; (2) the target loads a GPTQ checkpoint that contains `g_idx` entries outside the valid range `[-num_groups, num_groups)`, which only an attacker-controlled or tampered checkpoint would have; (3) the user or automated pipeline actively initiates model loading (UI:P - passive user interaction in CVSS 4.0 terms). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L) accurately reflects the threat model: attack is network-reachable via a malicious checkpoint hosted remotely, low complexity once the checkpoint is crafted, and no privileges are required to prepare the payload, but passive user interaction is required - someone must choose to load the checkpoint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to GPTQModel v7.3.0, which resolves this vulnerability by adding input validation in `_validate_g_idx_bounds()` called at model load in `post_init()` (commit 877c732f7d7dccd56a729844c6a5bd20f3aa8bb1, PR #2950, release at https://github.com/ModelCloud/GPTQModel/releases/tag/v7.3.0). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today