vLLM EUVD-2026-107006

Exploitation requires that the target vLLM instance (versions 0.7.3 up to but not including 0.31.0) is serving a multimodal model using an affected processor - the advisory names Isaac, InternVL, and H2OVL among others - and that the deployment accepts client-supplied per-request mm_processor_kwargs without validation or restriction. The attacker needs only network reachability to the inference API; no authentication (PR:N) and no user interaction (UI:N) are required. Limiting factors: text-only models and deployments that disable, hard-code, or sanitize mm_processor_kwargs are not exploitable, and the impact is confined to denial of service (server termination) with no data compromise, so the realistic risk is highest for multi-tenant or publicly exposed multimodal serving setups.

This is a legitimate availability-focused priority within AI/ML serving environments, though not a top-tier emergency across the broader infrastructure landscape. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a remote, unauthenticated, low-complexity attack with no user interaction, and impact is cleanly scoped to availability (VA:H) with no confidentiality or integrity effect - consistent with the CWE-400 uncontrolled-resource-consumption classification and the description's account of memory exhaustion crashing the shared server. The reported 8.7 score is high but reflects a pure denial-of-service outcome, not code execution or data exposure, so it should not be equated with a critical RCE. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data; per the precision rule this means no public exploit is identified at time of analysis, and exploitation is neither confirmed nor demonstrated. The practical risk is real for any multi-tenant or internet-exposed vLLM deployment serving affected multimodal models, because a single crafted request can terminate a server shared by many users, but the absence of exploitation signals (EPSS/KEV/POC) suggests this is a hardening priority rather than an actively-attacked flaw. Key missing data: no EPSS probability was supplied to gauge likelihood, and no SSVC decision metadata (automatable/exploitation status) was provided - these should be consulted before final prioritization.

An attacker with network access to a vLLM endpoint serving a multimodal model (e.g., InternVL, Isaac, or H2OVL) sends an inference request that includes per-request mm_processor_kwargs with oversized values such as an extreme image size, patch count, crop count, or frame count. The multimodal processor honors these client-controlled parameters and allocates vast amounts of memory, exhausting host resources and terminating the shared server for all tenants. No public exploit code is identified at time of analysis, but the attack is unauthenticated and low-complexity, requiring only a single crafted API request.