CVE-2026-110695: ExLlamaV2: heap overflow in safetensors loader

MEDIUMCISA: TRACK*

Published October 14, 2026

CISO Take

ExLlamaV2 through 0.3.2 has a heap buffer overflow in its safetensors tensor loader (STFile.get_tensor), triggered by a crafted data_offsets value in a model file. A public write-up and exploit details exist and the maintainers have not responded to the issue report, so no upstream patch should be expected soon. The CVSS of 6.3 is moderate and there is no KEV listing, EPSS data, or scanner template, but the attack requires only that a user or pipeline loads a malicious model, which is a routine action in local LLM inference. Teams running ExLlamaV2 (directly or through front ends such as TabbyAPI or text-generation-webui) should inventory deployments, load models only from trusted and hash-verified sources, and run inference in isolated, low-privilege containers until a fix ships.

Sources:NVDATLASGitHub Issues (turboderp-org/exllamav2)vuldb.com

What is the risk?

Medium overall. The vector is network-reachable with low complexity, but exploitation needs user interaction, meaning a victim must load an attacker-supplied model file. A public exploit write-up lowers the skill needed, and the vendor has not responded. Heap corruption can cause a crash at minimum, and may allow memory disclosure or code execution depending on allocator behavior and mitigations. No active exploitation, KEV listing, or EPSS score is available, so the likelihood is uncertain and should be re-checked as data arrives. The rating is limited by the user-interaction requirement and the lack of confirmed code execution.

How does the attack unfold?

Malicious model delivery

Attacker distributes a safetensors model with crafted data_offsets via a public hub or shared link.

AML.T0010.003

User loads model

A user or pipeline loads the file in ExLlamaV2, invoking STFile.get_tensor.

AML.T0011.000

Heap overflow

Out-of-bounds read or write on the heap corrupts memory in the inference process.

Impact

The service crashes or, with a tuned payload, the attacker gains code execution on the inference host.

AML.T0029

Malicious model delivery

Attacker distributes a safetensors model with crafted data_offsets via a public hub or shared link.

AML.T0010.003

User loads model

A user or pipeline loads the file in ExLlamaV2, invoking STFile.get_tensor.

AML.T0011.000

Heap overflow

Out-of-bounds read or write on the heap corrupts memory in the inference process.

Impact

The service crashes or, with a tuned payload, the attacker gains code execution on the inference host.

AML.T0029

How severe is it?

CVSS 3.1

6.3 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 30% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CLow

ILow

ALow

What should I do?

1 step

1) Check for a fixed release or patch on turboderp-org/exllamav2 (issue #820) and upgrade as soon as one exists. 2) Until then, load only models from trusted publishers, verify checksums and signatures, and avoid user-supplied or auto-downloaded model files. 3) Pre-validate safetensors headers (data_offsets must lie within file size and be consistent with tensor shape and dtype) before loading, or convert untrusted models with the safetensors library's bounds-checked loader. 4) Run inference in containers with minimal privileges, no secrets mounted, restricted egress, and resource limits. 5) Monitor for inference process crashes, segfaults, and unexpected child processes or outbound connections after model loads. 6) Inventory ExLlamaV2 use, including transitive use in front ends.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply ChainDoSCode ExecutionInferenceModelFrameworkAML.T0010.003- Model AML.T0011.000- Unsafe AI Artifacts AML.T0029- Denial of AI Service AML.T0058- Publish Poisoned Models

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and AI supply chain risks are managed

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-110695?

Is CVE-2026-110695 actively exploited?

No confirmed active exploitation of CVE-2026-110695 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-110695?

1) Check for a fixed release or patch on turboderp-org/exllamav2 (issue #820) and upgrade as soon as one exists. 2) Until then, load only models from trusted publishers, verify checksums and signatures, and avoid user-supplied or auto-downloaded model files. 3) Pre-validate safetensors headers (data_offsets must lie within file size and be consistent with tensor shape and dtype) before loading, or convert untrusted models with the safetensors library's bounds-checked loader. 4) Run inference in containers with minimal privileges, no secrets mounted, restricted egress, and resource limits. 5) Monitor for inference process crashes, segfaults, and unexpected child processes or outbound connections after model loads. 6) Inventory ExLlamaV2 use, including transitive use in front ends.

What systems are affected by CVE-2026-110695?

This vulnerability affects the following AI/ML architecture patterns: model serving, local LLM inference, model loading pipelines, self-hosted GPU inference.

What is the CVSS score for CVE-2026-110695?

CVE-2026-110695 has a CVSS v3.1 base score of 6.3 (MEDIUM). The EPSS exploitation probability is 0.36%.

What is the AI security impact?

Affected AI Architectures

model servinglocal LLM inferencemodel loading pipelinesself-hosted GPU inference

MITRE ATLAS Techniques

AML.T0010.003Model

AML.T0011.000Unsafe AI Artifacts

AML.T0029Denial of AI Service

AML.T0058Publish Poisoned Models

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. Affected is the function STFile.get_tensor of the file exllamav2/stloader.py of the component Safetensors Tensor Loader. Performing a manipulation of the argument data_offsets results in buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Exploitation Scenario

An attacker publishes a quantized model on a public hub, or shares one through a community forum, with a safetensors header whose data_offsets values exceed the real tensor bounds. A developer or an automated serving pipeline downloads and loads the model with ExLlamaV2. STFile.get_tensor reads using the attacker-controlled offsets, overflowing a heap buffer. The result is a crash of the inference service, or with a tuned payload, memory corruption leading to code execution under the service account and access to GPU resources, model weights, and credentials.

Weaknesses (CWE)

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferPrimary CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')Primary CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

[Requirements] Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer. Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.
[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Examples include the Safe C String Library (SafeStr) by Messier and Viega [REF-57], and the Strsafe.h library from Microsoft [REF-56]. These libraries provide safer versions of overflow-prone string-handling functions.

Source: MITRE CWE corpus.