ExLlamaV3 contains Denial of Service vulnerability

Published September 11, 2026 CVE-2026-84286

ExLlamaV3, a tool developers use to run AI language models efficiently on graphics cards, has a bug that lets a specially crafted input crash the program. An attacker who can feed the software a rigged input can knock it offline or make it behave unpredictably.

Severity
Not scoredNo CVSS score recorded
Fix
Not confirmedLast checked today
Exploited
Not confirmedNo confirmation recorded

How it works

  • An attacker crafts an input that sets an internal kernel parameter called K to zero.
  • That trick makes the software calculate a negative position when it looks up which processing routine to run next.
  • The program checks a table of only 24 valid entries but never confirms that K or a related checkpoint-derived index actually fall inside that table.
  • Because that check is missing, the software reads memory it was never supposed to touch on the graphics card.
  • That out-of-bounds access makes the CUDA graphics processing crash immediately.

What to do

Check whether your project depends on exllamav3 and specifically loads its exllamav3_ext CUDA extension, especially if it processes model checkpoints or inputs from outside your control. Compare your installed exllamav3 version or commit against the fix merged in pull request 310 on GitHub to see if you already have it.

Run this in the application environment you want to check:

python3 -m pip show exllamav3

Update exllamav3 to a build that includes the fix from pull request 310. Rebuild any dependent package, such as ezexl3 or MawDiscord, against the patched exllamav3_ext so the fix actually takes effect in your deployment. Watch the ExLlamaV3 GitHub repository for an official release or advisory confirming the patched version if one is not yet tagged.

Technical details

CVE-2026-84286 is an out-of-bounds memory access in the exllamav3_ext CUDA extension used by ExLlamaV3. Setting the kernel parameter K to 0 produces a negative array index; the code also uses a checkpoint-derived block index (cbi) to index a fixed 24-entry kernel-dispatch table without validating that either value stays in range. The result is a CUDA illegal memory access, crashing the process or leaving it in an unstable state.

No code execution or data exposure is described, only denial of service. The vendor merged a fix in GitHub pull request 310; CERT/CC notes at least two downstream dependents, ezexl3 and MawDiscord, among 49 tracked dependents of the repository.

References

View Original Source