---
id: CVE-2026-116502
title: >-
  turboderp-org ExLlamaV2 GPTQ Index q_matrix.cu make_sequential out-of-bounds
  write
summary: >-
  A flaw has been found in turboderp-org ExLlamaV2 up to 0.3.2. The impacted
  element is the function QMatrix::make_sequential of the file
  exllamav2/exllamav2_ext/cuda/q_matrix.cu of the component GPTQ Index Handler.
  Executing a manipulatio…
severity: medium
cvss: 4.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-787
  - CWE-119
vendor: turboderp-org
product: ExLlamaV2
affected:
  - ExLlamaV2 0.3.0
  - ExLlamaV2 0.3.1
  - ExLlamaV2 0.3.2
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T20:15:07.238Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116502'
references:
  - url: 'https://vuldb.com/vuln/426401'
    label: >-
      VDB-426401 | turboderp-org ExLlamaV2 GPTQ Index q_matrix.cu
      make_sequential out-of-bounds write
  - url: 'https://vuldb.com/vuln/426401/cti'
    label: 'VDB-426401 | CTI Indicators (IOB, IOC, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-116502'
    label: CVE-2026-116502 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1022425'
    label: >-
      Submit #1022425 | turboderp-org / ExLlamaV2 exllamav2 0.0.4 - 0.3.2 Heap
      out-of-bounds write caused by an unvalidated GPTQ `g_idx` v
  - url: 'https://github.com/turboderp-org/exllamav2/issues/817'
  - url: 'https://github.com/turboderp-org/exllamav2/'
tags:
  - cve.org
ingestedAt: '2026-10-26T20:39:42.618Z'
epss: 0.00152
epssPercentile: 0.04342
---

## Overview

A flaw has been found in turboderp-org ExLlamaV2 up to 0.3.2. The impacted element is the function QMatrix::make_sequential of the file exllamav2/exllamav2_ext/cuda/q_matrix.cu of the component GPTQ Index Handler. Executing a manipulation of the argument g_idx can lead to out-of-bounds write. The attack needs to be launched locally. The project was informed of the problem early through an issue report but has not responded yet.

## Affected

- `ExLlamaV2 0.3.0`
- `ExLlamaV2 0.3.1`
- `ExLlamaV2 0.3.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.