ExLlamaV3 EUVD-2026-120440

Exploitation requires the victim to load a maliciously crafted model checkpoint where the NGramEmbedding head_bias tensor contains more rows than the configured num_heads; the vulnerable ngram_dequant_kernel in exllamav3/exllamav3_ext/ngram.cu then indexes the bias by an unbounded per-row head id and reads outside the aux buffer. The decisive limiting factor is user interaction (CVSS UI:P): there is no exposed network service - the attacker must get a victim to download and load the malicious model file, so impact is confined to environments that ingest untrusted third-party checkpoints. Default, trusted models built with matching head_offsets/head_bios row counts are unaffected, and versions at or above 1.6.4 add load-time validation that rejects such malformed tensors.

This is a medium-severity information-disclosure issue that does not rise to an urgent, widely-exploitable priority. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L, E:P) scores 5.3, and the signals are internally consistent: the UI:P metric and the source-code evidence show the flaw is reached only when a victim loads a malformed model checkpoint whose head_bias tensor has more rows than the configured head count, letting the ngram_dequant CUDA kernel index outside the aux buffer (CWE-125 out-of-bounds read). So while the vector is nominally network (AV:N, because untrusted models are typically fetched from the internet), real exploitation is gated on the user choosing to load an attacker-supplied checkpoint - this is not remote unauthenticated code execution against a listening service. There is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of active or automated exploitation; a public PoC reference (poc.zip attachment on issue #525) exists but is not verified as working exploit code. The vuln.today Decision label is 'this_month', not act_now/emergency, which aligns with an exploitation-dependent, bounded-impact read primitive. Net: patch on a normal cadence; treat as elevated only for deployments that ingest untrusted third-party model files.

An attacker publishes a crafted ExLlamaV3-compatible model checkpoint (e.g. on a model-sharing hub) whose head_bias tensor row count does not match the configured number of heads. When a victim downloads and loads that model, the ngram_dequant kernel uses the unvalidated per-row head id to read past the aux/bias buffer in GPU memory, potentially disclosing adjacent memory contents or crashing the process. A public PoC reference exists but is not verified as working exploit code, and the attack requires the victim to load the malicious model (UI:P).