CVE-2026-86288

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-86288

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86288.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-86288

Published

2026-09-07T08:30:22Z

Modified

2026-09-09T03:47:24Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

ModelCloud GPTQModel Triton dequantization kernel tritonv2.py out-of-bounds

Details

A vulnerability has been found in ModelCloud GPTQModel up to 7.2.0. This vulnerability affects unknown code of the file gptqmodel/nn_modules/qlinear/tritonv2.py of the component Triton dequantization kernel. Such manipulation of the argument g_idx leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.3.0 is able to resolve this issue. The name of the patch is 877c732f7d7dccd56a729844c6a5bd20f3aa8bb1. Upgrading the affected component is recommended.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-119",
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86288.json"
}

References

Affected packages

Git / github.com/modelcloud/gptqmodel

Affected ranges

Type

GIT

Repo

https://github.com/modelcloud/gptqmodel

Events

Introduced

f73142960b91049feebbdcc113199687ded35be6

Fixed

877c732f7d7dccd56a729844c6a5bd20f3aa8bb1

Fixed

064cf560618def45c00defbdc3fd4784f8ba069f

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "7.0"
        },
        {
            "last_affected": "7.0"
        },
        {
            "introduced": "7.1"
        },
        {
            "last_affected": "7.1"
        },
        {
            "introduced": "7.2.0"
        },
        {
            "last_affected": "7.2.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

7.*

7.0

7.1

7.2.0

v7.*

v7.0.0

v7.1.0

v7.2.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86288.json"