Threats affecting pkg:github/turboderp-org/exllamav2

CVE-2026-116502 is an out-of-bounds write vulnerability in the turboderp-org ExLlamaV2 software versions 0.3.0, 0.3.1, and 0.3.2. The flaw exists in the QMatrix::make_sequential function within the GPTQ Index Handler component. It can be triggered by manipulating the g_idx argument locally, potentially leading to memory corruption. No patch or vendor response has been reported yet.

CVE-2026-110695 is a medium severity buffer overflow vulnerability in the turboderp ExLlamaV2 software, specifically affecting versions 0.3.0, 0.3.1, and 0.3.2. The flaw exists in the STFile.get_tensor function within the Safetensors Tensor Loader component. An attacker can remotely trigger the vulnerability by manipulating the data_offsets argument, potentially causing a buffer overflow. Exploit code is publicly available, but no official patch or vendor response has been provided yet.