CVE-2026-116502

ExLlamaV2 GPTQ metadata can write beyond allocated memory

turboderp-org · ExLlamaV2 GPTQ model loading

First documented disclosure · Review checkpoint

Summary

Loading crafted model metadata can corrupt host memory or crash the loader.

Severity and exploitation evidence

Medium · 4.8/10 · CVSS 4.0. Severity source.

Exploitation not established: Controlled sanitizer evidence; malicious exploitation is not established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

QMatrix::make_sequential uses unbounded g_idx values as histogram indexes.

Conditions required

A user or service loads an untrusted GPTQ checkpoint through the affected native extension.

Potential impact

An out-of-bounds host-memory write and crash are demonstrated; code execution or victim compromise is not established.

Affected versions and configurations

CNA lists 0.3.0–0.3.2; researcher tested commit 7dc12af.

Fix and mitigation status

No released fix verified; latest release remains 0.3.2 and the issue has no maintainer response.

Practical next steps

Load only vetted checkpoints in isolated, least-privilege workers; require validated quantization metadata before accepting untrusted models.

Operating lesson

Model data crossing into native kernels needs explicit bounds checks.

Evidence and limits

July 11 public issue precedes October 26 CVE publication. This ID covers the GPTQ g_idx write; the report’s other EXL2 findings are not automatically additional mapped CVEs. VulDB scores Medium 4.8 CVSS 4.0; direct VulDB evidence was not retrieved.

Sources