CVE-2026-116502: turboderp-org ExLlamaV2 GPTQ Index q_matrix.cu make_sequential out-of-bounds write
A flaw has been found in turboderp-org ExLlamaV2 up to 0.3.2. The impacted element is the function QMatrix::makesequential of the file exllamav2/exllamav2ext/cuda/qmatrix.cu of the component GPTQ Index Handler. Executing a manipulation of the argument gidx can lead to out-of-bounds write. The attack needs to be launched locally. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
An attacker needs local access and at least low-level privileges. The available information does not indicate that it can be exploited remotely or without prior access.
What input must an attacker control?
Exploitation requires manipulation of the g_idx argument passed to QMatrix::make_sequential in the GPTQ Index Handler. This can cause an out-of-bounds write in exllamav2/exllamav2_ext/cuda/q_matrix.cu.
Which versions are affected?
ExLlamaV2 versions up to and including 0.3.2 are reported as affected. No fixed version is identified in the available information.
Is a patch available?
The available information does not identify a patch or remediation release. It states that the project was informed through an issue report but had not responded at the time of the report.