CVE-2026-86288: ModelCloud GPTQModel Buffer Overflow Flaw

CVE-2026-86288 Overview

CVE-2026-86288 is an out-of-bounds read vulnerability [CWE-119] in ModelCloud GPTQModel versions up to 7.2.0. The flaw resides in the Triton dequantization kernel implemented in gptqmodel/nn_modules/qlinear/tritonv2.py. Loading an untrusted quantized model checkpoint with a manipulated g_idx tensor causes the kernel to read past allocated group buffers on the device. This can trigger denial of service and potentially disclose adjacent memory. The exploit has been publicly disclosed. Upgrading to version 7.3.0 resolves the issue via patch commit 877c732f7d7dccd56a729844c6a5bd20f3aa8bb1.

Critical Impact
An attacker distributing a malicious GPTQ checkpoint can trigger an out-of-bounds device read when the model is loaded, causing denial of service and possible adjacent-memory disclosure.

Affected Products

ModelCloud GPTQModel versions up to and including 7.2.0
Component: Triton dequantization kernel in gptqmodel/nn_modules/qlinear/tritonv2.py
Fixed in: GPTQModel 7.3.0

Discovery Timeline

2026-09-07 - CVE-2026-86288 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86288

Vulnerability Analysis

GPTQModel implements GPU-accelerated dequantization for quantized large language models using Triton kernels. The TritonV2Linear layer stores per-group scales and qzeros tensors, indexed by a g_idx tensor that maps each row of the weight matrix to its corresponding group. The Triton kernel resolves the group index with groups = where(g_idx < 0, g_idx + num_groups, g_idx) and then loads from scales and qzeros at that offset without validating the upper bound. When a checkpoint contains a g_idx value outside the valid range [-num_groups, num_groups), the kernel reads memory beyond the group buffers. The consequences include a device-side fault causing denial of service and potential disclosure of adjacent GPU memory contents.

Root Cause

The root cause is missing bounds validation on the g_idx tensor at model load time. The Triton kernel trusts the checkpoint-provided indices and performs pointer arithmetic on scales and qzeros without an upper-bound guard. Unlike the Torch backend, which safely faults on out-of-range scales[g_idx] gathers, the Triton path had no equivalent runtime check.

Attack Vector

Exploitation requires an attacker to deliver a crafted GPTQ checkpoint to a target that loads it with GPTQModel 7.2.0 or earlier. User interaction is needed to load the model, but no authentication or elevated privileges are required. Because model weights are commonly downloaded from public hubs, the attack surface extends to any pipeline that ingests third-party quantized models.

python

# Security patch from GPTQModel 7.3.0
# Source: https://github.com/ModelCloud/GPTQModel/commit/877c732f7d7dccd56a729844c6a5bd20f3aa8bb1

def _validate_g_idx_bounds(
    g_idx: Optional[torch.Tensor],
    scales: Optional[torch.Tensor],
    layer_name: str = "TritonV2Linear",
) -> None:
    """Reject checkpoint ``g_idx`` that would index the group buffers out of bounds.

    The Triton dequant kernel resolves each row's group as
    ``groups = where(g_idx < 0, g_idx + num_groups, g_idx)`` and then loads
    ``scales``/``qzeros`` at that group with no upper-bound guard, where
    ``num_groups = scales.shape[0]``. A value outside ``[-num_groups, num_groups)``
    therefore indexes past the buffer, causing an out-of-bounds device read
    (denial of service, possible adjacent-memory disclosure) when an untrusted
    checkpoint is loaded.
    """
    if g_idx is None or scales is None or g_idx.numel() == 0:
        return

    num_groups = scales.shape[0]
    g_min = int(g_idx.min())
    g_max = int(g_idx.max())
    if g_min < -num_groups or g_max >= num_groups:
        raise ValueError(
            f"{layer_name}: checkpoint g_idx is out of range for {num_groups} "
            f"scale group(s) (got min={g_min}, max={g_max}, valid "
            f"[{-num_groups}, {num_groups - 1}])"
        )

This patch validates g_idx bounds once at checkpoint load time rather than during every forward pass, matching the safe faulting behavior of the Torch backend. See the GitHub Commit 877c732 for the full patch.

Detection Methods for CVE-2026-86288

Indicators of Compromise

GPTQ checkpoint files containing a g_idx tensor with values outside [-num_groups, num_groups) where num_groups = scales.shape[0].
CUDA or Triton runtime errors, illegal memory access exceptions, or process crashes during model load or first forward pass on a TritonV2Linear layer.
Unexpected model downloads from unverified sources feeding inference pipelines using GPTQModel ≤ 7.2.0.

Detection Strategies

Scan quantized model checkpoints prior to loading to verify that every g_idx value satisfies -num_groups <= g_idx < num_groups.
Inventory Python environments for installed gptqmodel versions and flag any release at or below 7.2.0.
Monitor ML inference service logs for ValueError exceptions from TritonV2Linear or unexplained GPU kernel faults tied to dequantization paths.

Monitoring Recommendations

Track outbound network activity from ML workloads to model hubs and record checksums of downloaded checkpoints.
Alert on process crashes and CUDA cudaErrorIllegalAddress events in GPU-attached inference containers.
Correlate model-load events with subsequent service instability to identify potentially malicious checkpoints.

How to Mitigate CVE-2026-86288

Immediate Actions Required

Upgrade GPTQModel to version 7.3.0 or later in all environments that load quantized models.
Audit any GPTQ checkpoints obtained from untrusted or third-party sources and revalidate their provenance.
Restrict model-loading services to curated, signed checkpoints until the upgrade is confirmed everywhere.

Patch Information

The fix is delivered in GitHub Release v7.3.0 via patch commit 877c732f7d7dccd56a729844c6a5bd20f3aa8bb1. Additional context is available in GitHub Issue #2949 and GitHub Pull Request #2950. Install the fixed version with pip install --upgrade gptqmodel>=7.3.0.

Workarounds

If immediate upgrade is not feasible, implement a pre-load validator that rejects checkpoints whose g_idx values fall outside [-scales.shape[0], scales.shape[0]).
Switch affected pipelines to the Torch backend, which safely faults on out-of-range scales[g_idx] gathers, until the Triton path is patched.
Isolate model-loading workloads in sandboxed containers to contain denial-of-service impact from a malicious checkpoint.

bash

# Upgrade to the patched release
pip install --upgrade "gptqmodel>=7.3.0"

# Verify the installed version
python -c "import gptqmodel; print(gptqmodel.__version__)"