CVE-2026-93841: vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs ind

vLLM (a software framework for running large language models) versions up to 0.29.0 have a memory corruption vulnerability (a bug where data in memory gets overwritten incorrectly) in a component called Triton _bincount_kernel. Attackers can send audio requests with specially crafted token IDs (numeric identifiers for words or sounds) that exceed the vocabulary size (the total number of valid tokens the system knows), causing the system to write data outside its intended memory area and breaking how other requests handle repetition penalties (the mechanism that prevents the AI from repeating the same words too often).