CVE-2026-87083: Deserialization in tile-ai tilelang
Description
A weakness has been identified in tile-ai tilelang up to 0.1.14. This impacts the function KernelCache._load_kernel_from_disk of the file tilelang/cache/kernel_cache.py of the component Kernel Cache. Executing a manipulation can lead to deserialization. The attack may be performed from remote. This patch is called 11ec2397fe942e8b422d026af4a03d6e0a55ae6c. Applying a patch is advised to resolve this issue. Based on the release information, the fix has not been included in any official release yet.
CVSS v4.0
Score 5.1medium
Affected software
tile-ai
tilelang
pkg:pypi/tile-ai/tilelangcpe:2.3:a:tile-ai:tilelang:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-87083 describes a deserialization vulnerability in the tile-ai tilelang product affecting the KernelCache._load_kernel_from_disk function within the kernel_cache.py component. This vulnerability allows remote attackers to perform malicious deserialization manipulations. The issue affects all versions up to and including 0.1.14. A patch exists (commit 11ec2397fe942e8b422d026af4a03d6e0a55ae6c) but has not been incorporated into an official release yet. The product is a cloud service, which typically means vendor-managed remediation, but no explicit vendor advisory confirms this.
Potential Impact
Successful exploitation could allow remote attackers to manipulate deserialization in the affected function, potentially leading to unauthorized code execution or other impacts related to deserialization flaws. The CVSS 4.0 base score is 5.1 (medium), indicating a moderate impact with network attack vector, low complexity, and limited privileges required.
Mitigation Recommendations
A patch addressing this vulnerability exists but has not yet been included in any official release. Users should monitor vendor advisories for the official release containing the fix and apply it promptly once available. Since this is a cloud service, verify with the vendor whether remediation is managed server-side. Until the patch is applied, limit exposure of the affected component to untrusted networks if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-08T19:23:59.560Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Is Cloud Service
- true
Threat ID: 6aa0b867acd9273b4989b576
Added to database: 09/09/2026, 01:37:43 UTC
Last enriched: 09/09/2026, 03:07:43 UTC
Last updated: 10/23/2026, 15:10:15 UTC
Views: 72
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.