Out-of-bounds CUDA kernel dispatch in ExLlamaV3
ExLlamaV3’s EXL3 loader trusts a model-supplied index to choose a CUDA kernel and does not check that the index is in bounds. A malicious model can make the loader read and call an out-of-range function pointer, which reliably crashes the process when the model is loaded. Under particular host memory layouts, the same flaw may allow controlled indirect kernel dispatch during load rather than only a crash. Anyone who loads untrusted EXL3 models with ExLlamaV3 is affected; affected version ranges are not stated in the advisory. There is no known public proof of concept, the issue is not on CISA’s KEV list, and CVSS has not yet been scored.
What to do: Do not load EXL3 models from untrusted sources until a vendor fix is available and applied; model files must be treated as untrusted input. Check CERT VU#369611 and the ExLlamaV3 project for a patched release, and run model loading in a least-privilege environment so a crash or unexpected kernel dispatch cannot affect other workloads.
| Product | Affected |
|---|---|
| ExLlamaV3 project ExLlamaV3 (EXL3 loader) | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds. A malicious model can force the code to read and invoke an out‑of‑range function pointer, resulting in a reproducible crash. Under specific conditions involving certain host memory layouts, it may be possible for an attacker to exploit this vulnerability to achieve controlled indirect kernel dispatch during model load.
CERT/CC details CVE-2026-84286, an out-of-bounds memory access in ExLlamaV3's CUDA extension causing denial-of-service crashes; fixed via merged pull request.
Today 1K readers · 1.5K views · 1.1K reads · all time 159K views