CVE-2026-124994

A security flaw has been discovered in Turboderp-org ExLlamaV3 up to 1.6.3. The affected element is the function ngram_dequant of the file exllamav3/exllamav3_ext/ngram.cu of the component NGramEmbedding. The manipulation of the argument head_bias results in out-of-bounds read. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.4 is sufficient to fix this issue. The patch is identified as c9a57ae832a3035e264e0a412e1daf4ebb699b98. It is suggested to upgrade the affected component.

• CWE-119
• CWE-125

• https://github.com/turboderp-org/exllamav3/
• https://github.com/turboderp-org/exllamav3/commit/c9a57ae832a3035e264e0a412e1daf4ebb699b98
• https://github.com/turboderp-org/exllamav3/issues/525
• https://github.com/turboderp-org/exllamav3/releases/tag/v1.6.4
• https://github.com/user-attachments/files/33598849/poc.zip
• https://vuldb.com/cve/CVE-2026-124994
• https://vuldb.com/submit/1040626
• https://vuldb.com/vuln/433165
• https://vuldb.com/vuln/433165/cti

Published

Nov 9, 2026

Last Modified

Nov 10, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-124969The Optimole – Optimize Images | Convert WebP & AVIF | CDN &…7.1
• CVE-2026-12497The Paid Membership Plugin, Ecommerce, User Registration For…7.5
• CVE-2026-124970Improper Neutralization of Special Elements used in an SQL C…9.3
• CVE-2026-124987A vulnerability has been found in mikefarah yq up to 4.53.3.…6.3
• CVE-2026-124992A vulnerability was identified in nushell up to 0.116.1. Imp…3.3
• CVE-2026-124993An incorrect authorization vulnerability in the Security Adv…5.3
• CVE-2026-124996A weakness has been identified in Turboderp-org ExLlamaV3 up…6.3
• CVE-2026-124999A security vulnerability has been detected in braindecode up…6.3
• CVE-2026-1250The Court Reservation – Manage Your Court Bookings Online pl…7.5
• CVE-2026-12500The WP Travel Engine WordPress plugin before 6.8.2 does not…7.5
• CVE-2026-12501The WP Travel Engine WordPress plugin before 6.8.2 does not …5.3
• CVE-2026-12502Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo`…8.4