vLLM EUVD-2026-65457

Exploitation requires the vllm[deepstream] optional dependency (nvidia-deepstream-videodecode-cu13) to be explicitly installed on the server - it is not part of any default vLLM installation. The server must be running on Linux x86-64 with NVIDIA GPU hardware, CUDA 13 libraries, and system GStreamer packages present. The attacker must be able to submit inference requests to the vLLM API; no authentication is required (PR:N per the provided CVSS 4.0 vector). The DeepStream backend is selectable per-request via the media-io-kwargs API parameter without any server-side pre-configuration, which is the mechanism enabling unauthenticated backend activation. Exploitation is bounded to partial denial of service affecting concurrent video inference; no code execution, privilege escalation, or data exfiltration is possible. Default vLLM deployments without the deepstream extra are entirely unaffected.

The CVSS 4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VA:L reflects a low-complexity, unauthenticated network attack with partial availability impact only. Real-world risk is moderate: the impact is degradation of concurrent inference throughput rather than full service outage, data exfiltration, or code execution, keeping this well below critical tiers. There is no CISA KEV listing and no known public exploit code, so exploitation remains theoretical at time of analysis. EPSS data was not provided in the input, leaving exploitation probability unquantifiable from available signals. The primary risk amplifier is the zero-prerequisites attack condition - no authentication, no special server configuration, and no prior foothold required - meaning any internet-exposed vLLM endpoint with the deepstream optional dependency installed is theoretically reachable. However, the DeepStream dependency is not installed by default, materially narrowing the real-world exposed population. Operators running vLLM in AI inference pipelines where availability SLAs matter should prioritize the upgrade to 0.27.0 but need not treat this as an emergency break-glass response.

An attacker with unauthenticated network access to a vLLM API endpoint where the deepstream optional dependency is installed submits a crafted multimodal inference request specifying the DeepStream backend via the media-io-kwargs parameter, triggering lazy initialization of the process-wide GPU decode pool and submitting oversized or resource-intensive video content that bypasses pixel-limit controls. By issuing concurrent requests of this type, the attacker saturates the shared singleton decode pool, causing partial availability degradation for legitimate concurrent inference requests. No public exploit code has been identified at time of analysis.