AIKIDO-2025-10928

TL;DR

Affected versions of this package are vulnerable to Out-of-Bounds Memory Access in cuet.triangle_attention due to improper handling of return values in the backward pass of triangle attention operations, where the old code failed to assign and cast outputs from triangle_attention_cuda_bwd, leading to illegal memory access. An attacker could exploit this by crafting malicious inputs that trigger index overflows or out-of-bounds writes during gradient computation, potentially resulting in memory corruption, leaks from GPU memory, or arbitrary code execution. The patched code mitigates this by explicitly assigning return values and ensuring proper data type casting.