| Title | turboderp ExLlamaV2 0.3.2 (commit 6a2d8311) and master commit 7dc12af Heap-based Buffer Overflow |
|---|
| Description | A vulnerability was found in turboderp ExLlamaV2 0.3.2 and classified as high 8.8.
Affected is the safetensors tensor loader: the STFile.get_tensor function of
exllamav2/stloader.py and the stloader_read function of the exllamav2_ext
extension. The manipulation of the safetensors header field data_offsets in a
model.safetensors file leads to a heap-based buffer overflow. It is possible to
launch the attack remotely by supplying a crafted Hugging Face-style model
directory. User interaction is required because the victim must load the model
with an exllamav2 entry point such as the README command
"python test_inference.py -m <model>".
Technical Details
- Affected file/function: exllamav2/stloader.py STFile.get_tensor (lines 154-165)
and exllamav2/exllamav2_ext/ext_stloader.cpp stloader_read (lines 27-31, 63)
- Vulnerable parameter: data_offsets[1] - data_offsets[0] of a safetensors
header entry, which the loader uses as the copy length while allocating the
destination tensor independently from the header fields shape and dtype;
the two are never compared and the contiguity/coverage invariants of the
safetensors format are not enforced
- Attack vector: Network
- Privileges required: None
- Trigger condition: the victim loads a model directory whose safetensors
header declares a data_offsets range larger than the byte size implied by
shape x dtype; on the CPU loading path the extension preads the unchecked
length directly into the tensor's heap storage (verified: 28672 bytes written
into a 24576-byte allocation, AddressSanitizer heap-buffer-overflow WRITE)
Impact
- Confidentiality: High (attacker-controlled heap corruption, potential code execution)
- Integrity: High (out-of-bounds write past a heap allocation with controlled bytes)
- Availability: High (reliable process crash)
CVSS v3.1
Score: 8.8 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Timeline
- Discovered: 2026-09-27
- Vendor notified: 2026-09-27
- Patch released: [pending]
- Public disclosure: [pending]
Countermeasure
Validate every safetensors header entry before reading: require contiguous
non-overlapping data_offsets that exactly cover the data section and satisfy
data_offsets[1] - data_offsets[0] == prod(shape) * dtype_size, or parse
model.safetensors with the reference safetensors library, which enforces these
invariants. |
|---|
| Source | ⚠️ https://github.com/turboderp-org/exllamav2/issues/820 |
|---|
| User | r1ck99 (UID 100733) |
|---|
| Submission | 09/28/2026 14:07 (1 month ago) |
|---|
| Moderation | 10/14/2026 15:51 (16 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 419848 [turboderp ExLlamaV2 up to 0.3.2 Safetensors Tensor Loader exllamav2/stloader.py STFile.get_tensor data_offsets buffer overflow] |
|---|
| Points | 20 |
|---|