What’s Vulnerable › Vulnerabilities

CVE-2026-116502: turboderp-org ExLlamaV2 GPTQ Index q_matrix.cu make_sequential out-of-bounds write

• Severity: medium (CVSS 4.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-26 · updated 2026-10-27
• Weakness: CWE-119

Description

A flaw has been found in turboderp-org ExLlamaV2 up to 0.3.2. The impacted element is the function QMatrix::make_sequential of the file exllamav2/exllamav2_ext/cuda/q_matrix.cu of the component GPTQ Index Handler. Executing a manipulation of the argument g_idx can lead to out-of-bounds write. The attack needs to be launched locally. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

• turboderp-org ExLlamaV2: 0.3.0, 0.3.1, 0.3.2

References

• https://github.com/turboderp-org/exllamav2/
• https://github.com/turboderp-org/exllamav2/issues/817
• https://vuldb.com/cve/CVE-2026-116502
• https://vuldb.com/submit/1022425
• https://vuldb.com/vuln/426401
• https://vuldb.com/vuln/426401/cti

Get alerted when CVE-2026-116502 or the next vulnerability affects your stack