Executive brief
GPTQModel is a toolkit for compressing large language models using quantization techniques. A vulnerability in the Triton dequantization kernel allows an out-of-bounds read when loading a crafted quantized model with invalid group index parameters, potentially causing crashes or exposing adjacent memory from the GPU device.
Technical details
The vulnerability is an out-of-bounds (OOB) read in the Triton dequantization kernel (CWE-125) affecting the file gptqmodel/nn_modules/qlinear/tritonv2.py. The kernel resolves group indices using `where(g_idx < 0, g_idx + num_groups, g_idx)` but performs no upper-bound check when indexing scales/qzeros buffers against `num_groups`. When loading an untrusted quantized model checkpoint with `desc_act=True` and crafted g_idx values exceeding num_groups, the kernel reads out-of-bounds on the GPU device. The attack is network-reachable if a user loads a malicious model file. The fix validates g_idx at load time in TritonV2Linear.post_init, rejecting values outside the safe range `[-num_groups, num_groups)`. Patch version 7.3.0 (commit 877c732f7d7dccd56a729844c6a5bd20f3aa8bb1) is available.
Affected products
- ModelCloud GPTQModel up to 7.2.0
Timeline
- 2026-09-07: disclosed