CVE-2026-86288CWE-119CWE-125

CVE-2026-86288

Medium · published September 7, 2026

CVSS v3.1
6.3
EPSS
1%
Percentile
42.7
In the wild
Unconfirmed
What it is

A vulnerability has been found in ModelCloud GPTQModel up to 7.2.0. This vulnerability affects unknown code of the file gptqmodel/nn_modules/qlinear/tritonv2.py of the component Triton dequantization kernel. Such manipulation of the argument g_idx leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.3.0 is able to resolve this issue. The name of the patch is 877c732f7d7dccd56a729844c6a5bd20f3aa8bb1. Upgrading the affected component is recommended.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00511 · 42.7th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-125 · Out-of-bounds Read
Published
2026-09-07T13:17Z
References (9)
https://vuldb.com/cve/CVE-2026-86288 · [email protected]https://vuldb.com/submit/906135 · [email protected]https://vuldb.com/vuln/399447 · [email protected]https://vuldb.com/vuln/399447/cti · [email protected]https://github.com/ModelCloud/GPTQModel/ · [email protected]https://github.com/ModelCloud/GPTQModel/commit/877c732f7d7dccd56a729844c6a5bd20f3aa8bb1 · [email protected]https://github.com/ModelCloud/GPTQModel/issues/2949 · [email protected]https://github.com/ModelCloud/GPTQModel/pull/2950 · [email protected]https://github.com/ModelCloud/GPTQModel/releases/tag/v7.3.0 · [email protected]
EPSS history
Timeline
  • 08 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 07 SEP 08:30Z
    ModelCloud GPTQModel Triton dequantization kernel tritonv2.py out-of-bounds
    cvelistv5