Description

A vulnerability has been found in ModelCloud GPTQModel up to 7.2.0. This vulnerability affects unknown code of the file gptqmodel/nn_modules/qlinear/tritonv2.py of the component Triton dequantization kernel. Such manipulation of the argument g_idx leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.3.0 is able to resolve this issue. The name of the patch is 877c732f7d7dccd56a729844c6a5bd20f3aa8bb1. Upgrading the affected component is recommended.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-07T09:17:17.297Z",
  "pubdate": "2026-09-07T09:17:17.297Z",
  "executiveSummary": "An out-of-bounds read vulnerability exists in the Triton dequantization kernel within ModelCloud GPTQModel versions up to 7.2.0.\nThe vulnerability stems from improper validation of the g_idx argument, allowing for memory access outside of intended buffer boundaries.\nThis flaw enables remote attackers to trigger an out-of-bounds read, potentially leading to sensitive information disclosure or application crashes.\nThe exploit for this vulnerability is publicly disclosed, necessitating immediate attention.\nSuccessful exploitation allows an attacker to manipulate the execution flow through specifically crafted inputs provided to the dequantization routines.\nThe vulnerability affects the gptqmodel/nn_modules/qlinear/tritonv2.py file within the Triton dequantization component.\nThe impact includes potential leakage of memory contents and denial of service due to memory access violations.\nUsers are strongly advised to upgrade to version 7.3.0 to mitigate the risk associated with this publicly known exploit.",
  "technicalDetails": "The vulnerability originates in the gptqmodel/nn_modules/qlinear/tritonv2.py component of the GPTQModel library, specifically within the Triton-based dequantization kernels used for accelerated inference.\nThe root cause is a failure to properly sanitize or constrain the g_idx argument when invoked by the kernel. The g_idx parameter is used to map groups of weights during the dequantization process; if this index is manipulated or maliciously crafted, the kernel may perform memory addressing calculations that exceed the allocated memory bounds of the weights or scales tensors.\nExploitation occurs when an attacker influences the input parameters passed to the Triton kernel. By providing an out-of-range g_idx value, the kernel's load/store operations target memory addresses outside the intended buffer. In the context of Triton kernels, which are highly optimized GPU compute kernels, such an operation can result in the reading of adjacent memory locations that may contain sensitive data stored in GPU VRAM.\nThe attack flow involves the following stages: 1) The attacker gains the ability to influence the model's input processing or the metadata configuration used for quantization mapping. 2) The attacker crafts a request or a configuration state where the g_idx argument references invalid memory offsets. 3) The Triton kernel executes the dequantization logic using the malicious g_idx, resulting in an out-of-bounds read during the kernel's memory access cycle. 4) The resulting data from the out-of-bounds read is then processed by the model and potentially returned to the user or reflected in application logs, leading to sensitive data exfiltration.\nBecause the vulnerability exists in the core dequantization path, it does not require complex authentication or elevated privileges if the model inference endpoint is exposed remotely. The exploit is facilitated by the public disclosure of the vulnerability, which provides attackers with the necessary context to target the vulnerable g_idx logic effectively. The patch 877c732f7d7dccd56a729844c6a5bd20f3aa8bb1 addresses this by introducing rigorous bounds checking on the g_idx parameter, ensuring that all indices are validated against the actual dimensions of the weight tensor before kernel execution begins. Failure to apply this patch leaves the GPU memory space exposed to arbitrary read operations, which is a critical risk for deployments handling sensitive data."
}