vLLM EUVD-2026-97613

Exploitation requires: (1) a valid authenticated API session against the vLLM server (PR:L), and (2) that the audio transcription endpoint /v1/audio/transcriptions is reachable and the uploaded audio falls through to the PyAV/FFmpeg av.open() fallback path, which performs only a file-size check and no format/content validation before parsing. The attacker uploads a malformed IAMF container to reach FFmpeg's vulnerable IAMF parser. Limiting factors: authentication is required, so purely anonymous internet exploitation is not indicated; the audio/transcription feature must be enabled and exposed to the attacker; impact is confined to availability (process crash / DoS) with no confidentiality or integrity effect demonstrated. The flaw affects vLLM versions before 0.29.0.

This is a genuine but bounded availability risk rather than a top-tier emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) is internally consistent with the description: network-reachable, low attack complexity, no user interaction, authenticated (PR:L), and impact limited strictly to availability (VA:H; VC/VI = N). My independent assessment agrees - this is a pure denial-of-service (heap corruption crashing the API process), with no confirmed path to code execution or data compromise in the available data, despite heap overflows sometimes being RCE-capable in other contexts. No EPSS score was provided, the CVE is NOT in CISA KEV, and no public exploit was referenced, so exploitation status is 'no public exploit identified at time of analysis.' The main factor keeping this below critical is PR:L: an attacker must already be an authenticated API client, which limits exposure to multi-tenant or exposed-endpoint deployments. The 'Denial Of Service' tag aligns with the availability-only impact. Overall: real and easily repeatable for anyone with valid credentials, but the authentication requirement and availability-only impact make it an operational-resilience priority rather than a breach-grade one.

An authenticated client of a vLLM instance (e.g., a tenant in a shared inference deployment) repeatedly POSTs a malformed IAMF-format audio container to the /v1/audio/transcriptions endpoint. Because the upload is passed to the PyAV/FFmpeg av.open() fallback after only a file-size check, the malformed container reaches FFmpeg's vulnerable IAMF parser and triggers a heap overflow that corrupts memory and crashes the API process, denying service to all users. No public exploit code was referenced, and low attack complexity (AC:L) with no user interaction means the attack is trivially scriptable by anyone holding valid credentials.