CVE-2026-110695

EUVD-2026-101663

14.10.2026, 22:17

A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. Affected is the function STFile.get_tensor of the file exllamav2/stloader.py of the component Safetensors Tensor Loader. Performing a manipulation of the argument data_offsets results in buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Common Weakness Enumeration

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

References

https://github.com/3em0/cve_repo/blob/main/2026/ExLlamaV2-0.3.2-Heap-Buffer-Overflow-in-the-safetensors-tensor-loader(STFile.get_tensor-stloader_read).md

https://github.com/turboderp-org/exllamav2/issues/820

https://vuldb.com/cve/CVE-2026-110695

https://vuldb.com/submit/1003958

https://vuldb.com/vuln/419848

https://vuldb.com/vuln/419848/cti