Review
Turboderp-org
CVE published 2026-10-12
CVE-2026-84286
A vulnerability in ExLlamaV3's EXL3 loader allows an out-of-bounds read and write via a negative array index. A malicious model can cause a reproducible crash and potentially achieve controlled indirect kernel dispatch during model load under specific conditions. The vulnerability is triggered by an untrusted, model-supplied index used to select a CUDA kernel without bounds verification. This issue can le [truncated]