External risk intelligence

ExLlamaV3 Loader Out-of-Bounds Kernel Invocation Leading to Crash

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-84286

This vulnerability exists in a library loader (ExLlamaV3) used for processing model files. It requires a victim to load a specifically crafted, malicious model file. While the loader operates on data, it is not a network-facing service, gateway, or public API endpoint by design. Public internet exposure is uncommon as this is typically used in local development or internal model inference environments.

Out-of-bounds Read

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in the ExLlamaV3 EXL3 loader. The issue arises from the loader's failure to validate model-supplied data before invoking specific functions, potentially leading to crashes or, under certain circumstances, indirect code execution. The primary concern is to confirm if this technology is in use and assess any potential exposure.

A flaw in model loading can cause system crashes.
It could allow unauthorized code execution.
Confirm relevance and check for potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can leverage a malicious model file to trigger a vulnerability during the loading process of ExLlamaV3's EXL3 loader. This occurs when the loader uses an untrusted index to select a CUDA kernel without proper boundary checks. If successful, an attacker could potentially achieve controlled indirect kernel dispatch, leading to a reproducible crash or, under specific memory conditions, more severe consequences.

Requires loading a malicious model.
Vulnerable component accesses untrusted index.
Risk of crash or controlled code execution.

Live Threat

Current exploitation, exposure, and threat context

When loading a malicious model, an attacker could cause the application to crash by invoking an out-of-range function pointer. In specific scenarios, this may allow for controlled indirect kernel dispatch during model loading.

Code execution from a malicious model.
Invoking out-of-range function pointers.
Application crash and potential code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The ExLlamaV3 EXL3 loader's handling of untrusted model data presents a risk that could allow for controlled indirect kernel dispatch during model load. Identifying deployments of this loader, confirming their reachability and criticality, and assigning ownership are the critical first steps. Remediation planning should follow based on this assessment.

Application owners to investigate model loader usage.
Verify model loading process and reachability.
Plan remediation based on exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ExLlamaV3 and the EXL3 loader?

ExLlamaV3 is a library designed for running large language models, specifically optimized for high-speed inference on NVIDIA GPUs. The EXL3 loader is a component within this library that handles the reading and initialization of model files into GPU memory, preparing them for the application to use.

How does CVE-2026-84286 vulnerability work?

This vulnerability involves an out-of-bounds access weakness. When loading a model, the EXL3 loader uses an index provided by the model file to select a CUDA kernel. Because it fails to verify that this index is valid, a malicious model can force the loader to access and execute an incorrect or unintended memory location.

Does simply having the software installed trigger the bug?

No. The vulnerability is not triggered by background service activity or network traffic. It requires the explicit action of loading a specially crafted, malicious model file into an application that uses the vulnerable ExLlamaV3 loader.

Is my environment at risk according to Halo Surface Signal?

Halo Surface Signal indicates that this vulnerability is unlikely to be exposed to the internet. Because ExLlamaV3 is typically used in local development or internal inference environments rather than as a public-facing API or gateway, the risk of external exploitation is low.

What should I do if I use ExLlamaV3?

Start by identifying all applications or services in your environment that utilize the ExLlamaV3 library. Once located, confirm the context of how these models are loaded and who has the capability to introduce new model files, then plan for updates or security patches as they become available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.