A security vulnerability has been discovered in the exllamav3_ext CUDA extension, identified as CVE-2026-84286. The issue stems from an out-of-bounds memory access caused by unchecked array indexing. Specifically, when the kernel parameter K is set to 0, the code generates a negative array index. This occurs because the checkpoint-derived block index is used to access a fixed-size array without proper validation. The lack of a bounds check during the kernel-table dispatch process is the root cause. Exploiting this vulnerability can lead to an immediate denial of service or application instability. The vendor has released a fix in their main repository. Users should update their installations or apply the patch from the provided pull request. Downstream projects that depend on this library are also indirectly affected. Developers of these dependent repositories are urged to rebuild their packages against the patched version. This vulnerability was discovered by Nathan Keys and reported responsibly.