Out-of-Bounds Write Flaw in ExLlamaV2 by turboderp-org
CVE-2026-116502

4.8MEDIUM

Key Information:

Vendor

Turboderp-org

Status
Exllamav2
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116502?

A security issue exists in ExLlamaV2 versions up to 0.3.2, concerning the function QMatrix::make_sequential. This vulnerability allows for an out-of-bounds write due to improper validation of the argument g_idx in the GPTQ Index Handler. An attacker leveraging this flaw can execute code that may result in unintended memory manipulation, ultimately affecting application stability and security. Despite being reported promptly, there has been no acknowledgment from the development team.

Affected Version(s)

ExLlamaV2 0.3.0

ExLlamaV2 0.3.1

ExLlamaV2 0.3.2

References

https://vuldb.com/vuln/426401
vdb-entrytechnical-description
https://vuldb.com/vuln/426401/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-116502
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

m00dy (VulDB User)
VulDB CNA Team
.