CVE-2026-87083 Details
Description
A weakness has been identified in tile-ai tilelang up to 0.1.14. This impacts the function KernelCache._load_kernel_from_disk of the file tilelang/cache/kernel_cache.py of the component Kernel Cache. Executing a manipulation can lead to deserialization. The attack may be performed from remote. This patch is called 11ec2397fe942e8b422d026af4a03d6e0a55ae6c. Applying a patch is advised to resolve this issue. Based on the release information, the fix has not been included in any official release yet.
A deserialization vulnerability has been identified in tile-ai TileLang versions through 0.1.14, specifically within the Kernel Cache component. The issue arises in the function KernelCache._load_kernel_from_disk, located in tilelang/cache/kernel_cache.py. This vulnerability allows for arbitrary code execution, as the software uses cloudpickle (a superset of Python pickle) to serialize and deserialize kernel parameters and compiled functions. An attacker who can write files to the cache directory can execute malicious code when a cached kernel is loaded. The vulnerability can be exploited remotely.
Users are advised to update to the patched version of TileLang, which is available on the official GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 9, 2026CISA-ADP
Assessed Sep 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tile-ai/tilelang/ | [email protected] | ProductSource CodeVendor |
| https://github.com/tile-ai/tilelang/commit/11ec2397fe942e8b422d026af4a03d6e0a55ae6c | [email protected] | Source CodeVendor |
| https://github.com/tile-ai/tilelang/issues/2817 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/tile-ai/tilelang/pull/3143 | [email protected] | Issue TrackingVendor |
| https://vuldb.com/cve/CVE-2026-87083 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/911126 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/400289 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/400289/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| tile-ai tilelang | <= 0.1.14 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 9, 2026 | CVE Modified | CISA-ADP |
| Sep 9, 2026 | New CVE Received | [email protected] |