Exllamav3
Monthly
Out-of-bounds read in ExLlamaV3 through 1.6.3 affects the CUDA kernel routing_sel_norm_kernel used by hash-MoE routing, which indexes a score row with an expert id taken from the gate.tid2eid table without validating it against num_experts. The practical trigger is a victim loading and running a crafted or malformed model checkpoint that contains expert ids outside the valid range on the hash-MoE / block-sparse path (UI:P in the vendor CVSS 4.0 vector), yielding a bounded over-read with Low confidentiality, integrity and availability impact. Vendor CVSS 4.0 base score is 5.3, the decision label is this_month, and no public exploit code or active exploitation (KEV) is identified at time of analysis.
ExLlamaV3 through version 1.6.3 contains an out-of-bounds read in the CUDA kernel ngram_dequant (exllamav3/exllamav3_ext/ngram.cu) used by the NGramEmbedding module, which indexes a head_bias tensor by a per-row head id without bounds checking; a model checkpoint whose head_bias holds more rows than the configured num_heads therefore causes reads outside the aux buffer. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P) indicates unauthenticated remote-triggerable code paths, but the decisive constraint is user interaction: victim environments must download and load a maliciously crafted third-party checkpoint, so exposure is limited to deployments that ingest untrusted models; default trusted models with matching head_offsets/head_bias row counts are unaffected. There is no CISA KEV confirmation of active exploitation, and a public PoC reference (a zip attachment filed alongside the upstream issue) exists but is not verified as working exploit code; the vendor fix ships in 1.6.4.
Out-of-bounds read in ExLlamaV3 through 1.6.3 affects the CUDA kernel routing_sel_norm_kernel used by hash-MoE routing, which indexes a score row with an expert id taken from the gate.tid2eid table without validating it against num_experts. The practical trigger is a victim loading and running a crafted or malformed model checkpoint that contains expert ids outside the valid range on the hash-MoE / block-sparse path (UI:P in the vendor CVSS 4.0 vector), yielding a bounded over-read with Low confidentiality, integrity and availability impact. Vendor CVSS 4.0 base score is 5.3, the decision label is this_month, and no public exploit code or active exploitation (KEV) is identified at time of analysis.
ExLlamaV3 through version 1.6.3 contains an out-of-bounds read in the CUDA kernel ngram_dequant (exllamav3/exllamav3_ext/ngram.cu) used by the NGramEmbedding module, which indexes a head_bias tensor by a per-row head id without bounds checking; a model checkpoint whose head_bias holds more rows than the configured num_heads therefore causes reads outside the aux buffer. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P) indicates unauthenticated remote-triggerable code paths, but the decisive constraint is user interaction: victim environments must download and load a maliciously crafted third-party checkpoint, so exposure is limited to deployments that ingest untrusted models; default trusted models with matching head_offsets/head_bias row counts are unaffected. There is no CISA KEV confirmation of active exploitation, and a public PoC reference (a zip attachment filed alongside the upstream issue) exists but is not verified as working exploit code; the vendor fix ships in 1.6.4.