EUVD-2026-110316
GHSA-56qq-ww5r-ph3r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft GPTQ model with malicious g_idx
-
DeliveryVictim loads model locally in ExLlamaV2
-
Exploitmake_sequential processes attacker g_idx
-
ExecutionOut-of-bounds write corrupts memory
-
ImpactCrash or limited code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to load an attacker-controlled GPTQ-quantized model (or otherwise supply manipulated g_idx index data) into ExLlamaV2 version 0.3.0 through 0.3.2, which is then parsed by QMatrix::make_sequential in exllamav2_ext/cuda/q_matrix.cu. Exploitation is LOCAL only (AV:L) - there is no remote/network path - and per the input CVSS requires some privileges (PR:L) with low complexity and no user interaction flag set, though the realistic trigger is the victim's act of loading an untrusted model. Limiting factors: attacker must get a crafted model into the victim's inference pipeline, impact is confined to limited integrity and availability (no confidentiality loss), and no fix is currently published since the vendor has not responded. |
| Impact | All signals point to a genuinely low real-world priority despite the memory-corruption class. The CVSS 4.0 base score is only 4.8 (Medium), driven by a local attack vector (AV:L), low complexity (AC:L), required privileges (PR:L), and limited integrity/availability impact with no confidentiality impact (VC:N/VI:L/VA:L) - this is not a network-exploitable or scope-changing flaw. EPSS is 0.15% (4th percentile), among the lowest tiers, indicating negligible mass-exploitation likelihood. The vulnerability is NOT in CISA KEV, so there is no confirmed active exploitation, and no verified working exploit code is present in the input - only a GitHub issue report (#817) describing the problem. The vuln.today decision label is 'this_month' (routine patching cadence), not 'act_now' or 'emergency', which is consistent with the low EPSS and absence of KEV. The one caveat worth flagging: the realistic trigger is loading an attacker-crafted GPTQ model, which VulDB encoded as PR:L/UI:N; a malicious-model threat model is arguably better represented as PR:N with user interaction (victim loads the file), so the privilege/UI metrics may understate the no-account, file-based nature of the attack - but this does not raise the overall severity. Net: a real but low-urgency local memory-safety bug, not a drop-everything item. |
| Exploit ScenarioDerived | An attacker distributes a maliciously crafted GPTQ-quantized model containing manipulated g_idx index data. When a victim loads this model locally into ExLlamaV2 (≤0.3.2), QMatrix::make_sequential in q_matrix.cu processes the attacker-controlled g_idx and performs an out-of-bounds write (CWE-787), corrupting memory and potentially leading to crash or further compromise. No verified working exploit code is published; a public GitHub issue report (#817) describing the flaw exists, and the attack requires local access and low complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Out-of-bounds write in ExLlamaV2 0.3.0 through 0.3.2 can corrupt process memory when a crafted GPTQ-quantized model supplies manipulated g_idx index data that is processed by QMatrix::make_sequential in the CUDA extension. The issue is local-only and requires the victim to load an attacker-controlled model; impact is limited to integrity and availability with no confidentiality loss, and no public exploit was identified at time of analysis (EPSS 0.15%, low real-world priority).
RemediationAI
No vendor-released patch identified at time of analysis; the project was notified via https://github.com/turboderp-org/exllamav2/issues/817 and has not responded, and no fixed version is published. As compensating controls, only load GPTQ-quantized models from trusted, verified sources and validate model artifacts before use, which prevents a crafted g_idx from reaching QMatrix::make_sequential; additionally, run ExLlamaV2 inference in a sandboxed low-privilege process with constrained memory permissions to limit the blast radius of a memory-corruption event, though neither measure removes the underlying out-of-bounds write. Monitor https://github.com/turboderp-org/exllamav2/ and https://vuldb.com/vuln/426401 for a fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ExLlamaV2 is a Python/CUDA inference library for quantized large language models. GPTQ-quantized models carry a g_idx index that maps weights to quantization groups, and QMatrix::make_sequential in exllamav2/exllamav2_ext/cuda/q_matrix.cu consumes that index during model loading. The flaw is CWE-787 (out-of-bounds write): manipulated g_idx values are not adequately bounds-checked before a write. The CPE cpe:2.3:a:turboderp-org:exllamav2:*:*:*:*:*:*:*:* identifies the product with a wildcard version, while EUVD lists 0.3.0, 0.3.1 and 0.3.2 as affected. The sources describe the g_idx manipulation and the affected function but do not provide a deeper parser path or the exact missing bounds check.
Know when Exllamav2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Trigger is a victim loading an attacker-crafted GPTQ model, so no attacker privileges (PR:N) but user interaction (UI:R); local vector, no confidentiality impact, limited integrity/availability from the OOB write.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A flaw has been found in turboderp-org ExLlamaV2 up to 0.3.2. The impacted element is the function QMatrix::make_sequential of the file exllamav2/exllamav2_ext/cuda/q_matrix.cu of the component GPTQ Index Handler. Executing a manipulation of the argument g_idx can lead to out-of-bounds write. The attack needs to be launched locally. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Exploit-DB