CVE-2026-86288: A vulnerability has been found in ModelCloud GPTQModel up to 7.2.0. This vulnerability affects unknown code of the file
Summary
A vulnerability was discovered in ModelCloud GPTQModel up to version 7.2.0 that allows an attacker to cause an out-of-bounds read (accessing memory outside the intended range) by manipulating the g_idx argument in the Triton dequantization kernel (a component that decompresses compressed numerical data). This vulnerability can be exploited remotely and has been publicly disclosed.
Solution / Mitigation
Upgrading to version 7.3.0 resolves this issue. The patch is identified as 877c732f7d7dccd56a729844c6a5bd20f3aa8bb1.
Vulnerability Details
6.3(medium)
EPSS: 0.0%
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
network
low
none
required
September 7, 2026
Classification
Affected Vendors
Related Issues
CVE-2026-63086: text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compat
CVE-2024-37052: Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-86288
First tracked: September 7, 2026 at 08:06 AM
Classified by LLM (prompt v3) · confidence: 85%