An out‑of‑bounds read occurs in the routing_sel_norm_kernel function when the gate.tid2eid argument is manipulated. The kernel attempts to read beyond the bounds of an internal array, potentially exposing sensitive memory contents. The CVE description states that remote exploitation of this flaw is possible, meaning a well‑crafted payload could trigger the out‑of‑bounds access from an external source.

The flaw exists in all releases of Turboderp‑org ExLlamaV3 up to and including version 1.6.3. The vendor provides a fix in commit c9a57ae8, which was incorporated into release 1.6.4. Users of any affected version should upgrade to 1.6.4 or later to remove the vulnerability.

The CVSS score of 5.3 places the vulnerability at medium severity, and the EPSS score is currently unavailable, indicating no evidence of widespread exploitation. The issue is not listed in the CISA KEV catalog. A remote attacker could manipulate the gate.tid2eid input to induce the out‑of‑bounds read, potentially accessing arbitrary memory or triggering undefined behavior. Because the trigger is driven by external input, systems that expose the ExLlamaV3 library to untrusted data should consider this a significant risk.