CVE-2026-84286
—UnscoredPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- —
- Complexity
- —
- Privileges needed
- —
- User interaction
- —
- Impact
- —
- Weakness
- —
Impact
Attackers can crash the service or potentially achieve controlled indirect kernel execution during model loading. They need to convince the system to load a specially crafted, malicious EXL3 model file.
Root cause
The EXL3 loader directly uses an untrusted, model-provided index to select and invoke a CUDA kernel function pointer without boundary checks.
Affected systems
ExLlamaV3 versions prior to PR #310; exact release versions are not listed — check the vendor advisory.
Fix & remediation
Merge PR #310 or update to an ExLlamaV3 commit containing the patch. As an interim mitigation, restrict model loading exclusively to trusted local files and block untrusted external model imports.
$ pip install --upgrade git+https://github.com/turboderp-org/exllamav3.gitAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds. A malicious model can force the code to read and invoke an out‑of‑range function pointer, resulting in a reproducible crash. Under specific conditions involving certain host memory layouts, it may be possible for an attacker to exploit this vulnerability to achieve controlled indirect kernel dispatch during model load.