CVE-2026-124996 Details
Description
A weakness has been identified in Turboderp-org ExLlamaV3 up to 1.6.3. The impacted element is the function routing_sel_norm_kernel of the file exllamav3/exllamav3_ext/routing.cu of the component hash-MoE routing. This manipulation of the argument gate.tid2eid causes out-of-bounds read. Remote exploitation of the attack is possible. Upgrading to version 1.6.4 is sufficient to resolve this issue. Patch name: c9a57ae832a3035e264e0a412e1daf4ebb699b98. Upgrading the affected component is recommended.
A vulnerability allowing for an out-of-bounds read has been identified in Turboderp ExLlamaV3 versions through 1.6.3. The issue arises in the hash-MoE routing component, specifically within the 'routing_sel_norm_kernel' function of 'exllamav3/exllamav3_ext/routing.cu'. The vulnerability is triggered by unvalidated values from the 'gate.tid2eid' tensor, which are used as indices in a CUDA kernel, leading to unauthorized memory access. This flaw can be exploited remotely by loading a manipulated model package.
Users are advised to upgrade to ExLlamaV3 version 1.6.4, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/turboderp-org/exllamav3/ | [email protected] | Vendor |
| https://github.com/turboderp-org/exllamav3/commit/c9a57ae832a3035e264e0a412e1daf4ebb699b98 | [email protected] | Source CodeVendor |
| https://github.com/turboderp-org/exllamav3/issues/526 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/turboderp-org/exllamav3/releases/tag/v1.6.4 | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-124996 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1040627 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/433166 | [email protected] | BundlePermission Required |
| https://vuldb.com/vuln/433166/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | [email protected] |
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Turboderp-org ExLlamaV3 | <= 1.6.3 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 9, 2026 | New CVE Received | [email protected] |