Answer in brief
CVE-2026-84286 records a Unknown severity vulnerability in OOB Read/Write via Negative Array Index in exllamav3_ext Kernel Table. The current sources do not mark it as known exploited. The current feed maps Turboderp-org/ExLlamaV3 (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Turboderp-org/ExLlamaV3 (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Turboderp-org/ExLlamaV3generic | 3 | Not reported |
Published upstream
Oct 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 12, 2026
ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds. A malicious model can force the code to read and invoke an out‑of‑range function pointer, resulting in a reproducible crash. Under specific conditions involving certain host memory layouts, it may be possible for an attacker to exploit this vulnerability to achieve controlled indirect kernel dispatch during model load.
Quoted source text, attributed separately from HOL analysis.