CVE-2026-116502

A flaw has been found in turboderp-org ExLlamaV2 up to 0.3.2. The impacted element is the function QMatrix::make sequential of the file exllamav2/exllamav2 ext/cuda/q matrix.cu of the component GPTQ Index Handler. Executing a manipulation of the argument g idx can lead to out-of-bounds write. The attack needs to be launched locally. The project was informed of the problem early through an issue report but has not responded yet.