vLLM EUVD-2026-58066

Exploitation requires the attacker and a victim to be simultaneously co-batched on the same vLLM GPU instance - the attacker must be able to submit inference requests to the shared endpoint (no authentication required per CVSS PR:N), and a legitimate victim user's request must be present in the same batch (this co-batching requirement is the basis for CVSS UI:R). The integer overflow is triggered only when the batch token index (blockIdx.x) multiplied by 2 * d exceeds the 32-bit signed integer maximum of 2,147,483,647; for a model with hidden dimension d=4096, this threshold is reached at a token index of approximately 262,144, requiring very large batch sizes or very long sequences. Deployments using larger models (higher d) reach the overflow threshold at lower batch sizes. Single-tenant deployments where one user's requests are never co-batched with another's are not exploitable. The CVSS AV:N rating confirms the endpoint must be network-accessible, but no non-default configuration flag or special feature enablement is required beyond standard batched inference operation.

The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N accurately characterizes a network-reachable vulnerability with high confidentiality impact but constrained exploitability due to AC:H - the overflow fires only under specific combinations of batch token index and model hidden dimension, making reliable triggering non-trivial. EPSS data was not provided in the source intelligence, so exploitation probability cannot be quantified from that signal. The absence of a CISA KEV entry and no identified public standalone POC mean active in-the-wild exploitation is unconfirmed. However, the GitHub security advisory and PR diff publish sufficient technical detail that a determined researcher could construct a proof-of-concept. For multi-tenant deployments - shared API platforms, hosted inference services, or any architecture co-batching requests from distinct users - this is a genuine high-priority data privacy incident, since even a mid-sized municipal IT team in inowroclaw operating a shared vLLM endpoint would be exposed to cross-tenant prompt leakage. Single-tenant or air-gapped deployments face negligible real-world risk because there are no co-batched users whose data could be disclosed.

An attacker with access to a multi-tenant vLLM inference endpoint submits a sequence of requests timed to share a GPU batch with a concurrent victim user's request. By engineering requests that position their CUDA block index at a value where blockIdx.x * 2 * d overflows 32 bits for the deployed model's hidden dimension, the attacker's kernel invocation reads from the victim's input buffer. The response returned to the attacker contains a partial or complete copy of the victim's prompt or model output. No public standalone POC exists, but the GitHub PR diff and issue #42860 provide sufficient technical grounding for a skilled researcher to reproduce the condition.