{"data":{"id":"23aa919c-8a0b-4886-96fd-553ac793ff95","title":"CVE-2026-115913: vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multimodal audio encoder…","summary":"vLLM versions prior to 0.32.0 use eager attention by default in the Phi-4 multimodal audio encoder (phi4mm_audio.py and phi4mm_utils.py). A remote client can submit a single legal long audio clip, causing MultiHeadedAttention.forward_attention to materialize and retain full attention matrices in self.attn. The resulting quadratic GPU memory use can trigger an out-of-memory condition that terminates EngineCore for all users.","solution":"Fixed in version 0.32.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115913","publishedAt":"2026-10-26T17:17:19.053Z","cveId":"CVE-2026-115913","cweIds":["CWE-770"],"cvssScore":"6.5","cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["vLLM","Phi-4 multimodal"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"vLLM out-of-memory crash via long audio clip to Phi-4 multimodal encoder","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-26T18:09:59.509Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-26T18:10:02.766Z","patchAvailable":null,"disclosureDate":"2026-10-26T17:17:19.053Z","capecIds":["CAPEC-130"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null}}