Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-86288— ModelCloud GPTQModel Triton dequantization kernel tritonv2.py out-of-bounds

Quick assessment

Affected
ModelCloud GPTQModel
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ModelCloud GPTQModel 在 7.2.0 及更早版本中发现了安全漏洞。该漏洞位于组件 Triton 反量化内核的文件 中，影响该文件的未知代码。对参数 的特定操作会导致越界读取（out-of-bounds read）。该漏洞可被远程触发，利用代码已公开披露并可能被实际利用。升级到 7.3.0 版本可解决此问题。对应补丁的 commit 标识为 。建议升级受影响的组件以修复该漏洞。

CVSS 6.3 · Medium

Possible ATT&CK Techniques 2 AI

T1090 · Proxy T1527
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-86288

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ModelCloud GPTQModel Triton dequantization kernel tritonv2.py out-of-bounds
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability has been found in ModelCloud GPTQModel up to 7.2.0. This vulnerability affects unknown code of the file gptqmodel/nn_modules/qlinear/tritonv2.py of the component Triton dequantization kernel. Such manipulation of the argument g_idx leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.3.0 is able to resolve this issue. The name of the patch is 877c732f7d7dccd56a729844c6a5bd20f3aa8bb1. Upgrading the affected component is recommended.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ModelCloud GPTQModel 7.0 cpe:2.3:a:modelcloud:gptqmodel:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-86288

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-86288

请登录查看更多情报信息。

News Coverage for CVE-2026-86288 (1)

Other References for CVE-2026-86288 (7)

IV. Related Vulnerabilities

Same weakness: CWE-125

V. Comments for CVE-2026-86288

No comments yet

Leave a comment