EUVD-2026-97613
GHSA-8wc5-pcgr-pg48
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid vLLM API credentials
-
DeliveryUpload malformed IAMF audio container
-
ExploitBypass file-size-only validation to av.open()
-
ExecutionTrigger FFmpeg IAMF heap overflow
-
ImpactCrash API process (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires: (1) a valid authenticated API session against the vLLM server (PR:L), and (2) that the audio transcription endpoint /v1/audio/transcriptions is reachable and the uploaded audio falls through to the PyAV/FFmpeg av.open() fallback path, which performs only a file-size check and no format/content validation before parsing. The attacker uploads a malformed IAMF container to reach FFmpeg's vulnerable IAMF parser. Limiting factors: authentication is required, so purely anonymous internet exploitation is not indicated; the audio/transcription feature must be enabled and exposed to the attacker; impact is confined to availability (process crash / DoS) with no confidentiality or integrity effect demonstrated. The flaw affects vLLM versions before 0.29.0. |
| Impact | This is a genuine but bounded availability risk rather than a top-tier emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) is internally consistent with the description: network-reachable, low attack complexity, no user interaction, authenticated (PR:L), and impact limited strictly to availability (VA:H; VC/VI = N). My independent assessment agrees - this is a pure denial-of-service (heap corruption crashing the API process), with no confirmed path to code execution or data compromise in the available data, despite heap overflows sometimes being RCE-capable in other contexts. No EPSS score was provided, the CVE is NOT in CISA KEV, and no public exploit was referenced, so exploitation status is 'no public exploit identified at time of analysis.' The main factor keeping this below critical is PR:L: an attacker must already be an authenticated API client, which limits exposure to multi-tenant or exposed-endpoint deployments. The 'Denial Of Service' tag aligns with the availability-only impact. Overall: real and easily repeatable for anyone with valid credentials, but the authentication requirement and availability-only impact make it an operational-resilience priority rather than a breach-grade one. |
| Exploit ScenarioDerived | An authenticated client of a vLLM instance (e.g., a tenant in a shared inference deployment) repeatedly POSTs a malformed IAMF-format audio container to the /v1/audio/transcriptions endpoint. Because the upload is passed to the PyAV/FFmpeg av.open() fallback after only a file-size check, the malformed container reaches FFmpeg's vulnerable IAMF parser and triggers a heap overflow that corrupts memory and crashes the API process, denying service to all users. No public exploit code was referenced, and low attack complexity (AC:L) with no user interaction means the attack is trivially scriptable by anyone holding valid credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Heap corruption and process crash in vLLM audio transcription allow an authenticated remote attacker to repeatedly deny service to the inference API in versions before 0.29.0. Uploads to /v1/audio/transcriptions that fail primary decoding fall through to a PyAV/FFmpeg av.open() fallback guarded only by a file-size check, so a malformed IAMF container reaches FFmpeg's vulnerable IAMF parser and corrupts the heap, terminating the API process. The CVSS vector (PR:L) confirms authentication is required, impact is availability-only (no confidentiality or integrity effect), and no public exploit code or CISA KEV listing was identified at time of analysis; no EPSS score was supplied.
RemediationAI
Vendor-released patch: upgrade to vLLM 0.29.0 or later, per the GitHub advisory GHSA-m52c-39rh-f3gp, and rebuild or repull any container image or pinned wheel so the fixed PyAV/FFmpeg-facing code path is actually shipped. If immediate upgrade is not possible, the most direct trade-off is to disable or unmount the audio transcription route entirely - remove the /v1/audio/transcriptions handler or front it with a reverse proxy that returns 404/403 - which eliminates the fallback path but also removes any legitimate speech-to-text service; note that denying only unauthenticated access is insufficient because the vector requires PR:L, so authentication hardening does not close the hole. A narrower compensating control is to place an application-layer or gateway filter in front of the endpoint that rejects uploads whose declared or sniffed container is IAMF (and optionally enforces a strict allowlist of expected audio formats such as WAV, FLAC, MP3, or OGG), accepting the operational cost that legitimate IAMF audio will be rejected and that the filter must itself be robust to spoofed content types. Where the endpoint must remain open, isolate the vLLM API process so that repeated heap-corruption crashes do not take down co-located workloads - run it under a supervisor with restart limits, cap concurrent transcription requests, and rate-limit the endpoint per API key so an authenticated attacker cannot trivially loop the crash; these reduce blast radius but do not prevent the underlying heap overflow, and rate limiting will degrade throughput for legitimate batch transcription users. Upgrading to 0.29.0 remains the only fix that removes the vulnerability rather than constraining its reach.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-20 improper-input-validation defect at the boundary between vLLM's transcription service and its media-decoding dependencies. When a caller posts an audio file to /v1/audio/transcriptions, vLLM first attempts its normal decode path; on failure it falls back to av.open() from PyAV, the Python binding over FFmpeg's libavformat/libavcodec. In the affected releases that fallback enforces only a maximum file size and performs no container-format sniffing, magic-byte check, or codec allowlisting before handing the raw bytes to FFmpeg. An IAMF (Immersive Audio Model and Formats) container is therefore parsed by FFmpeg's IAMF demuxer/parser, which contains a heap overflow reachable from crafted input. Because the corrupting parser runs inside the vLLM API process rather than a sandboxed subprocess, the overflow manifests as heap corruption and an API-process crash. The affected-product CPE cpe:2.3:a:vllm-project:vllm:*:*:*:*:*:*:*:* carries wildcard version and platform fields, indicating all vLLM builds below the fixed release are in scope regardless of OS or deployment form. The defect is not a vLLM memory-safety bug per se: vLLM's contribution is the missing validation gate that lets untrusted audio reach a known-fragile third-party parser.
Know when Vllm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable endpoint with low complexity and no user interaction, but requires an authenticated API client (PR:L); impact is availability-only (process crash), so C:N/I:N/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow. Authenticated remote attackers can repeatedly upload malformed IAMF containers to /v1/audio/transcriptions, corrupting the heap and crashing the API process.
Technical POC Analysis
The bug class at the vLLM layer is CWE-20 (Improper Input Validation); the memory-safety fault it exposes is CWE-122 / CWE-787 in a native dependency.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Organizations using vLLM versions prior to 0.29.0 for audio transcription face a high-severity denial-of-service risk: any authenticated remote user can crash the inference API by uploading a malformed IAMF audio file, repeatedly disrupting transcription services. This affects the availability of AI-powered transcription workflows and could impact downstream operations that depend on them. Because no vendor-released patch is identified at time of analysis, leadership should prioritize interim mitigations and close monitoring.
Restrict /v1/audio/transcriptions to trusted authenticated users; block malformed IAMF containers via input validation or pre-processing; disable the endpoint if not needed; monitor for process crashes and configure automatic restarts. Apply vendor patch when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated critical severity (CVSS 10.0
vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. Rated critical sev
Information exposure in vLLM inference engine versions 0.8.3 to before 0.14.1. Invalid image requests to the multimodal
Timing-based API key recovery in vLLM before 0.11.0rc2 can let remote attackers bypass bearer-token authentication on de
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated high severity (CVSS 7.5), th
Denial of service in the vLLM LLM inference server (all versions prior to 0.24.0) allows a remote client to crash the sh
vLLM before version 0.14.1 contains a server-side request forgery vulnerability in the MediaConnector class where incons
Out-of-memory worker crashes in vLLM can be induced by a single small compressed audio payload submitted to the /v1/chat
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Rated medium severity (CVSS 6.5),
GPU memory exhaustion in vLLM versions prior to 0.28.0 lets an attacker with low-privileged API access (PR:L in the CVSS
Multimodal inference requests to vLLM deployments running versions prior to 0.28.0 can trigger a process-level assertion
Uncontrolled resource consumption in vLLM's OpenAI-compatible completions endpoint allows any authenticated API client t
Exploit-DB