CVE-2026-124994
Turboderp-org ExLlamaV3 NGramEmbedding ngram.cu ngram_dequant out-of-bounds
Description
A security flaw has been discovered in Turboderp-org ExLlamaV3 up to 1.6.3. The affected element is the function ngram_dequant of the file exllamav3/exllamav3_ext/ngram.cu of the component NGramEmbedding. The manipulation of the argument head_bias results in out-of-bounds read. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.4 is sufficient to fix this issue. The patch is identified as c9a57ae832a3035e264e0a412e1daf4ebb699b98. It is suggested to upgrade the affected component.
INFO
Published Date :
Nov. 9, 2026, 8:45 p.m.
Last Modified :
Nov. 9, 2026, 8:45 p.m.
Remotely Exploit :
No
Source :
VulDB
Solution
- Upgrade Turboderp-org ExLlamaV3 to version 1.6.4.
- Update the NGramEmbedding component.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-124994 vulnerability anywhere in the article.