EUVD-2026-101663
GHSA-w755-fw26-6333
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted safetensors model on a hub
-
ExploitVictim downloads and loads model in ExLlamaV2
-
ExecutionManipulated data_offsets overflow heap in STFile.get_tensor
-
ImpactProcess crash or limited memory corruption
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load an attacker-controlled safetensors model file into ExLlamaV2 ≤0.3.2; the crafted data_offsets value in the safetensors header is parsed by STFile.get_tensor in exllamav2/stloader.py, triggering the heap buffer overflow. Limiting factors: it is gated by user interaction (CVSS UI:P) - the attacker cannot trigger it against a passive running service, only when a malicious/untrusted model is actually loaded; it affects only deployments that ingest untrusted third-party model files (not trusted first-party models); no authentication is involved (PR:N); and vendor-assessed impact is Low, so the realistic outcome is denial of service or limited memory corruption rather than confirmed remote code execution. |
| Impact | Signals converge on LOW real-world priority. The input CVSS 4.0 base score is 2.1, reflecting limited impact (VC:L/VI:L/VA:L, no subsequent-system impact) and a passive user-interaction requirement (UI:P) - i.e., a victim must load an attacker-supplied safetensors file. Exploit maturity is E:P (proof-of-concept), consistent with the public exploit note and the referenced write-up; this is publicly available exploit code, NOT confirmed active exploitation. The CVE is NOT in CISA KEV, and no EPSS score was provided in the input, so exploitation-probability cannot be quantified - state this gap explicitly rather than assuming. The 'attack is possible remotely' claim (AV:N) is best understood as remote DELIVERY of a malicious model file rather than unauthenticated network RCE: the actual trigger is local parsing of a crafted file, which is why UI:P is present. A CWE-119 buffer overflow often raises RCE concern, but the vendor-scored impacts are only Low across C/I/A, pointing to a crash/limited-corruption outcome rather than reliable code execution. Net: this is a genuine memory-safety bug with public PoC, but low severity, user-interaction-gated, and unpatched (vendor non-responsive) - manage it, do not treat it as an emergency. |
| Exploit ScenarioDerived | An attacker publishes a malicious safetensors model (e.g., on a model-sharing hub) whose data_offsets header field is manipulated. A user downloads and loads it with ExLlamaV2 ≤0.3.2, and STFile.get_tensor processes the crafted offsets, triggering a heap buffer overflow that crashes the process or corrupts limited memory. A public proof-of-concept exists (CVSS E:P), lowering the effort to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Loading an untrusted safetensors model file into ExLlamaV2 up to and including 0.3.2 triggers a heap buffer overflow in the Safetensors Tensor Loader, because STFile.get_tensor in exllamav2/stloader.py acts on the data_offsets value from the model header without validating that it stays within the mapped buffer. The path is network-reachable and requires no credentials (PR:N), but it is gated by user interaction (UI:P, CVSS 4.0) - an attacker cannot hit a passive inference server, only one that is actually made to load a malicious or tampered third-party model. Publicly available exploit code exists and no CISA KEV entry is associated, so this is a proof-of-concept-driven issue rather than confirmed in-the-wild exploitation; the vendor-assessed CVSS 4.0 score is 2.1 (Low), and our independent assessment lands at a similar Low real-world priority because the realistic outcome is denial of service or limited memory corruption rather than reliable remote code execution.
RemediationAI
No vendor-released patch identified at time of analysis - the project was notified early via the GitHub issue report (https://github.com/turboderp-org/exllamav2/issues/820) and has not responded, so there is no tagged fixed version to cite and upgrading within the 0.3.x line does not remove the flaw. The single most effective control is to treat model files as untrusted input: only load safetensors artifacts from sources you control or from publishers you have cryptographically verified (signature or pinned SHA-256), because the bug requires the victim to actually load the crafted file - this eliminates the attack path entirely but is impractical for deployments whose purpose is consuming community models. Where untrusted models must be loaded, add an out-of-band header validation step before handing the file to ExLlamaV2: parse the safetensors JSON header yourself and reject any tensor whose data_offsets are non-monotonic, inverted (end < begin), or exceed the file's data-section length, or pre-open the file with a hardened reader such as the reference safetensors library that enforces these bounds; the trade-off is that this pre-check is a separate code path that must itself be kept current. Additionally, run inference workers as an unprivileged, non-root user inside a sandbox (container with read-only rootfs, seccomp/AppArmor profile, hard memory caps, no host mounts, no outbound credentials) so that a heap overflow degrades into a contained crash or DoS instead of a host compromise, and monitor for out-of-bounds crash signatures (SIGSEGV in stloader/model-load paths) as a detection signal. If the loader cannot be protected, disabling safetensors ingestion of third-party files and restricting inference to GGUF or otherwise pre-validated model formats removes the vulnerable code path at the cost of format flexibility. Track the upstream issue and EUVD-2026-101663 for a vendor fix, and re-evaluate when a patched release is published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ExLlamaV2 is a Python/CUDA+ROCm inference engine for large language models, and its safetensors loader (exllamav2/stloader.py) memory-maps model weight files in the Hugging Face safetensors format. That format stores an 8-byte little-endian header length followed by a JSON header whose per-tensor entries carry a data_offsets pair of [begin, end] byte positions relative to the start of the data section. STFile.get_tensor consumes those offsets to locate and read the tensor, and the reported flaw is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer): a manipulated data_offsets value is not range-checked against the actual buffer, so the read/write proceeds past the end of the allocated heap region. The consequence is heap corruption and, depending on allocator behavior and how the resulting tensor is later consumed, at minimum a crash and potentially controlled memory access. The root cause class is entirely input-validation driven - the trust boundary is the model file itself, so any deployment that fetches model artifacts from public hubs, community contributors, or user uploads is exposing attacker-controlled bytes to this parser. The technique is not novel: the safetensors ecosystem, ONNX, and pickle-based loaders have all been repeatedly targeted through malformed header metadata, which is why model-file parsing is now treated as a hostile-input surface.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Trigger requires loading an attacker-supplied model file (UI:R) delivered remotely (AV:N), no auth (PR:N); memory-safety bug yields only limited C/I/A impact.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. Affected is the function STFile.get_tensor of the file exllamav2/stloader.py of the component Safetensors Tensor Loader. Performing a manipulation of the argument data_offsets results in buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB