Memory Management Issue in vLLM Audio Encoder by VLLM Project

CVE-2026-115913

What is CVE-2026-115913?

The vLLM project has identified a memory management issue in its Phi-4 multimodal audio encoder, present in versions prior to 0.32.0. Due to the default use of eager attention in the encoding process, a remote client can exploit this vulnerability by submitting a long audio clip. This action can trigger the MultiHeadedAttention.forward_attention method, leading to the retention of full attention matrices in the self.attn component. As a consequence, this results in excessive GPU memory consumption which may cause an out-of-memory condition, adversely impacting the EngineCore and causing disruptions for all users. This vulnerability has been addressed in version 0.32.0.

References