Integer Overflow Vulnerability in vLLM Inference Engine for Large Language Models

CVE-2026-73558

What is CVE-2026-73558?

The vLLM inference engine for large language models contains an integer overflow vulnerability in the activation_kernels.cu file, specifically within the act_and_mul_kernel function. This flaw can lead to the unintended exposure of one user's inference results to another within the same inference batch. As a result, sensitive information might be leaked between different requests, potentially compromising user privacy. A patch was issued in version 0.27.0 to mitigate this issue. It is critical for users to update to the latest version to safeguard against this vulnerability.

References