Intel Gaudi vLLM Plugin CVE-2026-27765

Exploitation requires local system access and an authenticated user account with at least low-privilege permissions (PR:L, AV:L per CVSS 4.0). The vulnerability is rooted in the Ring 3 user application layer, meaning the attacker must be able to invoke or interact with the vLLM Gaudi plugin process directly on the target host. No special configuration beyond having the plugin installed and accessible is required, and attack complexity is low (AC:L). Exploitation is limited by the local access requirement - remote unauthenticated attackers cannot exploit this vulnerability. The impact is further bounded to availability only, with no path to confidentiality or integrity compromise.

The CVSS 4.0 score of 6.8 (Medium) is consistent with the threat model: AV:L requires physical or logical local access, PR:L requires an authenticated user, AC:L indicates low attack complexity, and the impact is limited exclusively to availability (VA:H) with no confidentiality or integrity compromise. There is no scope change to subsequent systems (SC/SI/SA all N). EPSS data was not provided in the intelligence inputs; given the local-only vector, niche product footprint, and absence of KEV listing or POC, real-world exploitation probability is assessed as low. This is not a remotely exploitable vulnerability and is constrained to environments where Intel Gaudi hardware and the vLLM plugin are deployed with multi-user or untrusted local access. The risk is primarily relevant to AI inference infrastructure shared across teams or accessed via multi-tenant compute environments. No conflicts between signals were identified.

A low-privileged local user with authenticated access to a system running the vLLM Gaudi inference plugin submits specially crafted input - such as a malformed inference request or malicious plugin parameter - that the plugin fails to properly validate. This triggers an unhandled error condition within the Ring 3 application space, causing the plugin or associated vLLM service to crash and become unavailable. No exploit code has been publicly identified at the time of analysis.