Log in Start free

Vulnerability · Published Oct 26, 2026 · Assigned by VulDB

CVE-2026-116502turboderp-org ExLlamaV2 GPTQ Index q_matrix.cu make_sequential out-of-bounds write

Medium 4.4

In plain English

A medium-severity out-of-bounds write in ExLlamaV2 from turboderp-org. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)4.4Medium
Exploit odds (30 days)0.2%top 95.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw has been found in turboderp-org ExLlamaV2 up to 0.3.2. The impacted element is the function QMatrix::make_sequential of the file exllamav2/exllamav2_ext/cuda/q_matrix.cu of the component GPTQ Index Handler. Executing a manipulation of the argument g_idx can lead to out-of-bounds write. The attack needs to be launched locally. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

VendorProductVersions
turboderp-org ExLlamaV2 0.3.00.3.10.3.2

Weakness: CWE-787, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:X/RC:C

References