{"id":"CVE-2026-84286","revision":"a140359264b04f229648ec1b63185d34","records":[{"revision":"a140359264b04f229648ec1b63185d34","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-84286","aliases":[],"title":"OOB Read/Write via Negative Array Index in exllamav3_ext Kernel Table","description":"ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds. A malicious model can force the code to read and invoke an out‑of‑range function pointer, resulting in a reproducible crash. Under specific conditions involving certain host memory layouts, it may be possible for an attacker to exploit this vulnerability to achieve controlled indirect kernel dispatch during model load.","state":0,"publishedAt":"2026-10-12T17:01:16.032+00:00","modifiedAt":"2026-10-19T11:04:47.147+00:00","affected":[{"ecosystem":"Vendor product","name":"ExLlamaV3","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Turboderp-org\",\n                    \"product\": \"ExLlamaV3\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"3\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://kb.cert.org/vuls/id/369611","https://github.com/turboderp-org/exllamav3/pull/310"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-84286","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-84286","identifiers":["CVE-2026-84286"]},"retained":false,"historicalAffected":[]}],"coverage":[]}