ExLlamaV2: out-of-bounds write in the CUDA GPTQ index handler via crafted g_idx

Impact

ExLlamaV2 up to 0.3.2 writes out of bounds in QMatrix::make_sequential (exllamav2/exllamav2_ext/cuda/q_matrix.cu) when the GPTQ g_idx argument is manipulated. On a GPU node that loads quantised models supplied by users or pulled from a model hub, the group-index array is attacker-controlled data inside the model file, so loading an untrusted GPTQ checkpoint corrupts memory in the serving process. The record rates this local, low-privilege, integrity and availability impact only - no confidentiality loss claimed - so the realistic outcome is a crashed or corrupted inference worker rather than a demonstrated host takeover. Shared inference hosts that let tenants bring their own weights carry the exposure.

Who can reach it

Local, authenticated: a user who can run ExLlamaV2 on the node or hand it a GPTQ model file whose g_idx values they control. No network path in the record.

What to do

No fixed version is published - the record states the project was notified through an issue report and has not responded. Mitigate: do not load GPTQ checkpoints from untrusted sources, pin model provenance, and run ExLlamaV2 workers in per-tenant isolation so a corrupted process cannot reach others. Restarting the worker clears a crash but does not address the flaw.

References

Related entries

• vLLM: OpenAI-compatible server ships a wildcard CORS origin, letting any web page drive it from a browserCVE-2026-115917 · vLLM OpenAI-compatible API server (Starlette CORSMiddleware default)Medium
• Intel Extension for PyTorch: unsafe deserialization of untrusted data allows local privilege escalationCVE-2026-35502 · Intel Extension for PyTorch (untrusted deserialization)Medium
• diffusers (shard file loader): Path traversal in `_get_checkpoint_shard_files`CVE-2026-65920 · diffusers (shard file loader)Medium
• vLLM: derender endpoints process caller-supplied response objects before limits, exhausting CPU and memoryCVE-2026-71486 · vLLM OpenAI-compatible server (/v1/completions/derender and /v1/chat/completions/derender)Medium
• vLLM: attacker-chosen X-Request-Id overwrites another tenant's cached query embedding in /scoreCVE-2026-105755 · vLLM late-interaction scoring cache at /score and /rerank (query_key derived from X-Request-Id)Medium
• AMD graphics driver - dynamic power management (DPM) array index validation: An unvalidated array index in the driver'sCVE-2023-31306 · AMD graphics driver - dynamic power management (DPM) array index validationLow