{"schema":"threatline.record/2","record":{"id":"CVE-2026-84286","aliases":[],"summary":"OOB Read/Write via Negative Array Index in exllamav3_ext Kernel Table","details":"ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds. A malicious model can force the code to read and invoke an out‑of‑range function pointer, resulting in a reproducible crash. Under specific conditions involving certain host memory layouts, it may be possible for an attacker to exploit this vulnerability to achieve controlled indirect kernel dispatch during model load.","categories":["Unclassified"],"product":"ExLlamaV3","vendor":"Turboderp-org","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-84286","source_modified_at":"2026-10-19T11:04:47.147Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"ExLlamaV3","vendor":"Turboderp-org","versions":[{"status":"affected","version":"3"}],"defaultStatus":null}],"fixed_versions":[],"cvss":9.8,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.00589,"percentile":0.4748,"score_date":"2026-10-23"},"published_at":"2026-10-12T17:01:16.032Z","modified_at":"2026-10-19T11:04:47.147Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-84286","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-19T11:04:47.147Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84286","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://kb.cert.org/vuls/id/369611"},{"source":"CVE List","url":"https://github.com/turboderp-org/exllamav3/pull/310"},{"source":"CVE List","url":"https://www.kb.cert.org/vuls/id/369611"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CISA ADP","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"total","assessed_at":"2026-10-19T11:04:41.538596Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-19T11:04:47.147Z","content_hash":"c7c6cad07183c36354ecc1468d80d48fda262f1a098c834a9ca0691397f7c9a1"}}