ExLlamaV3 EUVD-2026-97575

Exploitation requires the victim to load an attacker-controlled EXL3-format model file in ExLlamaV3's EXL3 loader; the trigger is the model-supplied trellis dimension that yields K and the kernel index cbi, which before the fix were used to index reconstruct_kernel_instances / reconstruct_had_kernel_instances without bounds checking during reconstruct_slice / reconstruct_had_slice at model-load time. Limiting factors: the attacker must get the target to load an untrusted/malicious checkpoint (no exploitation against a benign, trusted model), the reliably achievable outcome is a denial-of-service crash, and the step beyond that - controlled indirect kernel dispatch - is explicitly gated on 'certain host memory layouts,' making arbitrary code execution non-deterministic and non-default.

The input CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N) overstates real-world risk and conflicts with the actual exploitation model described. The vulnerability is triggered only when ExLlamaV3 loads an attacker-supplied EXL3 model checkpoint - the malicious index (cbi, derived from trellis.shape[-1]//16 in the untrusted file) selects an out-of-bounds CUDA kernel function pointer. This is file-processing of attacker-controlled input, not a network-facing service, so the AV:N/PR:N/UI:N framing is questionable: in practice a victim must obtain and load a hostile model, which argues for a local vector with required user interaction - verify intent with CERT/CC (VU#369611). The description and the reporter's 'Denial Of Service' tag agree that the reliable, reproducible outcome is a crash; code execution ('controlled indirect kernel dispatch') is explicitly conditional ('under specific conditions involving certain host memory layouts, it may be possible'), i.e. not demonstrated. EPSS is low at 0.20% (10th percentile), there is no CISA KEV listing and no public exploit, consistent with a theoretical/DoS-weighted issue rather than mass exploitation. The true priority driver is supply-chain context (untrusted models from hubs like Hugging Face are common in the local-LLM ecosystem), not a wormable network flaw. Net: a legitimate memory-safety bug warranting patching, but the 9.8 should be treated as inflated relative to the confirmed DoS impact.

An attacker publishes a trojanized EXL3-format model to a public model hub; a developer or inference service downloads and loads it with ExLlamaV3. During model load the loader reads the attacker-controlled K/cbi index and dispatches an out-of-range kernel function pointer, reliably crashing the process and, under specific host memory layouts, potentially achieving controlled kernel dispatch. No public exploit code exists, and code execution beyond the crash is described as conditional rather than demonstrated.