CVE-2026-87083

tile-ai tilelang Kernel Cache kernel_cache.py KernelCache._load_kernel_from_disk deserialization

State: Published
Severity: 5.1 Medium
Published: Sep 9, 2026
Updated: Sep 9, 2026
Reserved: Sep 8, 2026

Description

A weakness has been identified in tile-ai tilelang up to 0.1.14. This impacts the function KernelCache._load_kernel_from_disk of the file tilelang/cache/kernel_cache.py of the component Kernel Cache. Executing a manipulation can lead to deserialization. The attack may be performed from remote. This patch is called 11ec2397fe942e8b422d026af4a03d6e0a55ae6c. Applying a patch is advised to resolve this issue. Based on the release information, the fix has not been included in any official release yet.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X	VulDB
3.1	5.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
3.0	5.5 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C	VulDB

Weaknesses

CWE-502 Deserialization
CWE-20 Improper Input Validation

Affected Products

Product	Versions
tilelangtile-ai	0.1.0Affected 0.1.1Affected 0.1.2Affected 0.1.3Affected 0.1.4Affected 0.1.5Affected 0.1.6Affected 0.1.7Affected 0.1.8Affected 0.1.9Affected 0.1.10Affected 0.1.11Affected 0.1.12Affected 0.1.13Affected 0.1.14Affected

References

VDB-400289 | tile-ai tilelang Kernel Cache kernel_cache.py KernelCache._load_kernel_from_disk deserializationvdb-entrytechnical-description
VDB-400289 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-87083 | CVE Analysis and Reportthird-party-advisory
Submit #911126 | tile-ai tilelang main Remote Code Executiothird-party-advisory
https://github.com/tile-ai/tilelang/issues/2817issue-tracking
https://github.com/tile-ai/tilelang/pull/3143issue-trackingpatch
https://github.com/tile-ai/tilelang/commit/11ec2397fe942e8b422d026af4a03d6e0a55ae6cpatch
https://github.com/tile-ai/tilelang/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.