vLLM CVE-2026-90554

The vulnerable code path is only reachable when all three conditions are met simultaneously: (1) vLLM version is >=0.10.2 and <0.28.0; (2) a NanoNemotronVL model is actively loaded and serving requests; and (3) the server is started with use_audio_in_video=True, which is a non-default opt-in flag. The attacker must be able to submit multimodal video input to the vLLM inference API endpoint. vLLM's default configuration does not enforce API key authentication, so no credentials are required against a default deployment, though operators may have added authentication via a reverse proxy or vLLM's API key flag. Deployments not running NanoNemotronVL, or running it without the audio flag, are entirely unaffected regardless of vLLM version. No chaining with other vulnerabilities is required - the memory exhaustion occurs entirely within the audio decode operation triggered by a single crafted request.

Real-world risk is moderate and tightly scoped by the deployment requirement. The CVSS 4.0 score of 6.9 correctly isolates impact to availability only (VA:H; VC/VI/SC/SI/SA all N), with no lateral or confidentiality consequences. The provided vector uses AV:L (Local), which is inconsistent with the description - vLLM is an inference server accessed via API, and an attacker submitting crafted video input over that API is operating over a network (AV:N is likely more accurate); this discrepancy should be verified with the vLLM project. No EPSS score was provided, and the absence of a KEV listing places this in the standard patch-cycle tier rather than emergency response. The exploitation condition - a NanoNemotronVL model served specifically with use_audio_in_video=True - substantially narrows the affected population: even a mid-sized ML platform operator in sanok would only be exposed if running that exact model variant with that non-default audio flag enabled. In multi-tenant inference deployments, a successful OOM attack can disrupt all concurrent users sharing the server process, amplifying the blast radius beyond the single attacker request. The AT:N designation in the provided vector is debatable given the non-default configuration requirement; AT:P would arguably be more precise.

An attacker with API access to a vLLM instance serving a NanoNemotronVL model configured with use_audio_in_video=True submits a crafted, highly compressed short video file - potentially only a few kilobytes - as multimodal input to the inference endpoint. The server passes the video bytes to _extract_audio_from_videos, which calls load_audio_pyav without any size or duration constraint, causing PyAV to fully decode the audio track and allocate gigabytes of memory. This triggers an out-of-memory condition on the inference server, crashing the process or severely degrading service availability for all concurrent users. No public proof-of-concept code has been identified, but the attack vector is fully described in the advisory and straightforward to implement.