Exllamav2
Monthly
Out-of-bounds write in ExLlamaV2 0.3.0 through 0.3.2 can corrupt process memory when a crafted GPTQ-quantized model supplies manipulated g_idx index data that is processed by QMatrix::make_sequential in the CUDA extension. The issue is local-only and requires the victim to load an attacker-controlled model; impact is limited to integrity and availability with no confidentiality loss, and no public exploit was identified at time of analysis (EPSS 0.15%, low real-world priority).
Out-of-bounds write in ExLlamaV2 0.3.0 through 0.3.2 can corrupt process memory when a crafted GPTQ-quantized model supplies manipulated g_idx index data that is processed by QMatrix::make_sequential in the CUDA extension. The issue is local-only and requires the victim to load an attacker-controlled model; impact is limited to integrity and availability with no confidentiality loss, and no public exploit was identified at time of analysis (EPSS 0.15%, low real-world priority).