CVE-2026-124996mediumCWE-119CWE-125

CVE-2026-124996: fallo de gravedad media en Turboderp-org ExLlamaV3

Turboderp-org ExLlamaV3 hash-MoE routing routing.cu routing_sel_norm_kernel out-of-bounds

Publicada el

Seguir esta CVE+ Monitorear ExLlamaV3

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.2%
A weakness has been identified in Turboderp-org ExLlamaV3 up to 1.6.3. The impacted element is the function routing_sel_norm_kernel of the file exllamav3/exllamav3_ext/routing.cu of the component hash-MoE routing. This manipulation of the argument gate.tid2eid causes out-of-bounds read. Remote exploitation of the attack is possible. Upgrading to version 1.6.4 is sufficient to resolve this issue. Patch name: c9a57ae832a3035e264e0a412e1daf4ebb699b98. Upgrading the affected component is recommended.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
Productos afectados
Turboderp-org · ExLlamaV3
CVEs relacionadas — Turboderp-org ExLlamaV3

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-84286CRITICALOOB Read/Write via Negative Array Index in exllamav3_ext Kernel TableEPSS 0.6%CVE-2026-124994MEDIUMTurboderp-org ExLlamaV3 NGramEmbedding ngram.cu ngram_dequant out-of-boundsEPSS 0.3%