Junglewise Threat Intelligence

CVE-2026-86288: ModelCloud GPTQModel out-of-bounds read in Triton dequantization kernel

CVE-2026-86288 · Severity: medium · CVSS 6.3 · Published 2026-09-07

Executive brief

GPTQModel is a toolkit for compressing large language models using quantization techniques. A vulnerability in the Triton dequantization kernel allows an out-of-bounds read when loading a crafted quantized model with invalid group index parameters, potentially causing crashes or exposing adjacent memory from the GPU device.

Technical details

The vulnerability is an out-of-bounds (OOB) read in the Triton dequantization kernel (CWE-125) affecting the file gptqmodel/nn_modules/qlinear/tritonv2.py. The kernel resolves group indices using `where(g_idx < 0, g_idx + num_groups, g_idx)` but performs no upper-bound check when indexing scales/qzeros buffers against `num_groups`. When loading an untrusted quantized model checkpoint with `desc_act=True` and crafted g_idx values exceeding num_groups, the kernel reads out-of-bounds on the GPU device. The attack is network-reachable if a user loads a malicious model file. The fix validates g_idx at load time in TritonV2Linear.post_init, rejecting values outside the safe range `[-num_groups, num_groups)`. Patch version 7.3.0 (commit 877c732f7d7dccd56a729844c6a5bd20f3aa8bb1) is available.

Affected products

  • ModelCloud GPTQModel up to 7.2.0

Timeline

  • 2026-09-07: disclosed

References