CISA: ExLlamaV3 issues update for CUDA bounds-check flaw
49th article in the last 90 days, one of 604 articles referencing Cybersecurity and Infrastructure Security Agency (CISA). Previous coverage: CISA alerts on AOMEI Backupper amwrtdrv.sys physical disk writes (Sep 2026).
Companies mentioned
Best suited for
- Seniority
- Director
- Job function
- Chief Information Security Officer
- Persona
- Security Operations Leader
- Buyer role
- Decision Maker / Budget Holder
- Buyer journey
- Need to Buy
- Adoption curve
- Early Majority
- Technology maturity
- Market Correction
- Industry
- Information Technology / Software & Services / IT Services / Internet Services & Infrastructure
Our classification, not the publisher's statement. Best suited for, not only for.
ExLlamaV3 exllamav3_ext contains an out-of-bounds (OOB) memory access issue in its CUDA extension that can result in denial of service or application instability. The vulnerability is tracked as CVE-2026-84286.
The exllamav3_ext module has an OOB memory access vulnerability due to insufficient input validation. When the kernel parameter K is set to 0 in a crafted input, the extension generates a negative array index and causes a CUDA illegal memory access. The root cause is a missing bounds check in the kernel-table dispatch process, where the checkpoint-derived block index (cbi) is used to access a fixed 24-entry array without confirming that either K or cbi fall within safe limits.
Primary impacts include denial of service through process crashes and potential unstable execution states within applications utilizing the library.
The vendor addressed the vulnerability in the main repository. Updates are available, and a fix is provided via the merged pull request at https://github.com/turboderp-org/exllamav3/pull/310.
Downstream projects using this library are indirectly exposed, with 49 total dependencies currently tracking the repository. Notable downstream projects directly affected include UnstableLlama / ezexl3 and Ednaordinary / MawDiscord, and developers and maintainers of these dependent repositories are encouraged to rebuild their packages against the patched version of exllamav3_ext.
Blog post, originally published at kb.cert.org.