CVE-2026-110695 in ExLlamaV2
Summary
by MITRE • 10/15/2026
A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. Affected is the function STFile.get_tensor of the file exllamav2/stloader.py of the component Safetensors Tensor Loader. Performing a manipulation of the argument data_offsets results in buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified within turboderp ExLlamaV2 versions up to 0.3.2 represents a critical security flaw located in the Safetensors Tensor Loader component, specifically affecting the STFile.get_tensor function found in the exllamav2/stloader.py module. This library is commonly utilized for loading large language model weights efficiently, and its role as an intermediary between storage formats and runtime execution makes it a high-value target for attackers seeking to compromise AI inference pipelines or training environments. The core technical flaw stems from improper validation of input arguments, particularly the data_offsets parameter which dictates where specific tensor data begins within the file structure. When this argument is manipulated by an attacker, the function fails to perform adequate bounds checking before attempting to read or map memory regions associated with the requested tensors.
This lack of rigorous boundary verification leads directly to a buffer overflow condition. In practical terms, when the provided offsets exceed the actual size of the allocated buffer or point to invalid memory locations outside the expected range, the application attempts to write beyond the limits of its allocated heap or stack space. This type of error is classified under CWE-120 Buffer Copy without Checking Size of Input and often intersects with CWE-787 Out-of-bounds Write depending on whether the overflow results in overwriting adjacent memory structures. The consequence of such a buffer overflow can range from application crashes leading to denial of service conditions, where availability is compromised due to segmentation faults or core dumps, to more severe outcomes involving arbitrary code execution if an attacker can precisely control the overwritten data and return addresses within the process memory space.
The operational impact of this vulnerability is significant given that ExLlamaV2 is frequently deployed in server-side environments handling model inference requests over networks. Because the attack vector allows for remote exploitation, a malicious actor does not need local access to the system hosting the AI service. By crafting a specially designed safetensors file with malformed data_offsets and submitting it through an API endpoint or interface that utilizes this library, an attacker can trigger the buffer overflow remotely. The fact that public exploits are already available exacerbates the risk profile substantially, as automated scanning tools and threat actors can rapidly identify vulnerable instances across the internet without requiring complex custom development efforts to achieve initial access or privilege escalation within the host environment.
Industry frameworks such as MITRE ATT&CK categorize this type of vulnerability under techniques related to Initial Exploitation and potentially Defense Evasion if used in conjunction with other exploits, specifically aligning with T1203 Exploitation for Client Execution when targeting client-side applications or broader system compromise vectors when applied to server services. The absence of a timely response from the project maintainers despite early issue reports highlights a gap in security maintenance practices that leaves users exposed during the window between disclosure and patch availability. Organizations relying on this software must treat it as compromised until an official fix is released, necessitating immediate mitigation strategies such as network segmentation to restrict access to inference endpoints, input validation at the application layer before passing data to the library, or temporarily disabling the affected functionality if possible while monitoring for signs of exploitation attempts in system logs.