CVE-2026-84286

Overview

An out‑of‑bounds memory access flaw in the exllamav3_ext CUDA extension can crash or destabilize GPU‑accelerated inference applications, leading to denial of service.

Description

An out-of-bounds (OOB) memory access vulnerability involving unchecked array indexing has been identified in the exllamav3_ext compute unified device architecture (CUDA) extension. Successful exploitation can lead to an immediate denial of service or application instability. This vulnerability is tracked as CVE-2026-84286.

Impact

The vulnerability primarily affects availability, as an attacker can trigger application crashes or instability. Confidentiality and integrity are not directly compromised, but repeated crashes could expose sensitive data if the application is restarted with stale state.

Remediation

['Update exllamav3_ext to the latest patched version released by the vendor.', 'If no patch is available, rebuild the extension with bounds‑checked array access or use a static analysis tool to detect similar issues.', 'Apply the latest NVIDIA GPU driver updates, which may include memory protection enhancements.', 'Implement runtime monitoring for GPU memory errors and set up automated alerts for sudden crashes or high error rates.', 'Isolate GPU workloads in containers or virtual machines to contain potential crashes.', 'Enforce strict input validation for all data fed into the CUDA extension.']

Risk context

Although no CVSS score is provided, the OOB access can cause immediate denial of service in GPU‑heavy workloads. The lack of a patch or mitigation increases the urgency for defenders to apply the latest updates or enforce runtime safeguards.

Affected products

• exllamav3_ext
• CUDA
• NVIDIA GPU
• Llama inference
• OpenAI Llama
• GPU compute