CVE-2026-124994 Details
Description
A security flaw has been discovered in Turboderp-org ExLlamaV3 up to 1.6.3. The affected element is the function ngram_dequant of the file exllamav3/exllamav3_ext/ngram.cu of the component NGramEmbedding. The manipulation of the argument head_bias results in out-of-bounds read. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.4 is sufficient to fix this issue. The patch is identified as c9a57ae832a3035e264e0a412e1daf4ebb699b98. It is suggested to upgrade the affected component.
A security vulnerability allowing for out-of-bounds read has been identified in Turboderp ExLlamaV3 versions through 1.6.3. The issue arises in the NGramEmbedding component, specifically within the 'ngram_dequant' function of 'exllamav3/exllamav3_ext/ngram.cu'. The vulnerability is triggered by a model-controlled head index that is applied to the head_bias tensor without proper validation, leading to unauthorized memory access. This flaw can be exploited remotely, and has been publicly disclosed along with an available exploit.
Users are advised to upgrade to ExLlamaV3 version 1.6.4, where this vulnerability has been addressed. The update is available on the project's GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 9, 2026CISA-ADP
Assessed Nov 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/turboderp-org/exllamav3/ | [email protected] | Vendor |
| https://github.com/turboderp-org/exllamav3/commit/c9a57ae832a3035e264e0a412e1daf4ebb699b98 | [email protected] | Source CodeVendor |
| https://github.com/turboderp-org/exllamav3/issues/525 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/turboderp-org/exllamav3/releases/tag/v1.6.4 | [email protected] | Release NotesVendor |
| https://github.com/user-attachments/files/33598849/poc.zip | [email protected] | Broken LinkExploit |
| https://vuldb.com/cve/CVE-2026-124994 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1040626 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/433165 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/433165/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | [email protected] |
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Turboderp-org ExLlamaV3 | <= 1.6.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 10, 2026 | CVE Modified | CISA-ADP |
| Nov 9, 2026 | New CVE Received | [email protected] |