CVE-2026-109311: vLLM heap overflow DoS

CISO Take

vLLM before 0.29.0 hands uploaded audio to the PyAV/FFmpeg fallback after checking only file size, so a malformed IAMF container sent to /v1/audio/transcriptions triggers an FFmpeg parser heap overflow that crashes the API process. The flaw needs only a low-privilege authenticated account, and the attack is network-reachable, low-complexity and repeatable. Impact is limited to availability (CVSS 6.5, no confidentiality or integrity impact in the advisory). There is no public exploit, no Nuclei template, no KEV listing and no EPSS score yet, so there is no evidence of active exploitation. Still, heap corruption in a native parser can sometimes be escalated, so treat it as more than a pure crash bug until proven otherwise. Upgrade vLLM to 0.29.0 or later, and until then restrict or disable the transcription endpoint for untrusted users and make sure the service restarts automatically.

Sources:NVDGitHub Advisoryvulncheck.comATLAS

What is the risk?

Medium. Exploitation is easy for any authenticated user (low privileges, no user interaction, low complexity), and the impact is repeatable denial of service on the inference API. Exposure depends on whether the audio transcription endpoint is enabled and reachable by multi-tenant or semi-trusted users. There is no known in-the-wild exploitation and no public PoC. The heap overflow in FFmpeg's IAMF parser is memory corruption, which carries theoretical but unconfirmed escalation risk. Treat the advisory's availability-only impact as the baseline.

How does the attack unfold?

Initial Access

Attacker authenticates with a low-privilege account or API key to the vLLM OpenAI-compatible server.

AML.T0040

Exploitation

Attacker uploads a malformed IAMF container to /v1/audio/transcriptions, which reaches FFmpeg's vulnerable parser via av.open().

AML.T0049

Impact

Heap corruption crashes the API process, and repeated uploads keep the inference service unavailable.

AML.T0029

Initial Access

Attacker authenticates with a low-privilege account or API key to the vLLM OpenAI-compatible server.

AML.T0040

Exploitation

Attacker uploads a malformed IAMF container to /v1/audio/transcriptions, which reaches FFmpeg's vulnerable parser via av.open().

AML.T0049

Impact

Heap corruption crashes the API process, and repeated uploads keep the inference service unavailable.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	—	No patch
95.4K94 dependentsPushed 6d ago27% patched~37d to patchFull package profile →

Do you use vLLM? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 41% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

1) Upgrade vLLM to 0.29.0 or later. 2) If patching is delayed, disable the audio transcription endpoint or block it at the gateway or WAF for untrusted users. 3) Enforce strict authentication, per-user rate limits and upload size caps on audio endpoints. 4) Run vLLM under a supervisor (Kubernetes, systemd) with automatic restart and health checks, and isolate transcription workloads from text-generation replicas. 5) Detect repeated process crashes or segfaults/SIGABRT in vLLM logs correlated with uploads to /v1/audio/transcriptions, and review request logs for unusual or non-standard audio container types. 6) Where feasible, rebuild or update the PyAV/FFmpeg dependency and restrict the allowed demuxers or audio formats.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoSInferenceAPIAML.T0029- Denial of AI Service AML.T0040- AI Model Inference API Access AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to unknown risks and system failures

OWASP LLM Top 10

LLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-109311?

vLLM before 0.29.0 hands uploaded audio to the PyAV/FFmpeg fallback after checking only file size, so a malformed IAMF container sent to /v1/audio/transcriptions triggers an FFmpeg parser heap overflow that crashes the API process. The flaw needs only a low-privilege authenticated account, and the attack is network-reachable, low-complexity and repeatable. Impact is limited to availability (CVSS 6.5, no confidentiality or integrity impact in the advisory). There is no public exploit, no Nuclei template, no KEV listing and no EPSS score yet, so there is no evidence of active exploitation. Still, heap corruption in a native parser can sometimes be escalated, so treat it as more than a pure crash bug until proven otherwise. Upgrade vLLM to 0.29.0 or later, and until then restrict or disable the transcription endpoint for untrusted users and make sure the service restarts automatically.

Is CVE-2026-109311 actively exploited?

No confirmed active exploitation of CVE-2026-109311 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-109311?

1) Upgrade vLLM to 0.29.0 or later. 2) If patching is delayed, disable the audio transcription endpoint or block it at the gateway or WAF for untrusted users. 3) Enforce strict authentication, per-user rate limits and upload size caps on audio endpoints. 4) Run vLLM under a supervisor (Kubernetes, systemd) with automatic restart and health checks, and isolate transcription workloads from text-generation replicas. 5) Detect repeated process crashes or segfaults/SIGABRT in vLLM logs correlated with uploads to /v1/audio/transcriptions, and review request logs for unusual or non-standard audio container types. 6) Where feasible, rebuild or update the PyAV/FFmpeg dependency and restrict the allowed demuxers or audio formats.

What systems are affected by CVE-2026-109311?

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference servers, speech-to-text pipelines, multi-tenant AI gateways.

What is the CVSS score for CVE-2026-109311?

CVE-2026-109311 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.48%.

What is the AI security impact?

Affected AI Architectures

model servingLLM inference serversspeech-to-text pipelinesmulti-tenant AI gateways

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0040AI Model Inference API Access

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow. Authenticated remote attackers can repeatedly upload malformed IAMF containers to /v1/audio/transcriptions, corrupting the heap and crashing the API process.

Exploitation Scenario

An attacker with a low-privilege API key for a shared vLLM inference platform crafts a malformed IAMF container and uploads it to /v1/audio/transcriptions. The server passes it through the PyAV/FFmpeg av.open() fallback, where the IAMF parser overflows a heap buffer and crashes the API process. The attacker scripts repeated uploads to keep the service in a crash loop. This takes down chat, completion and transcription workloads for every tenant, and the attacker can also use it to disrupt a competitor or force failover costs.

Weaknesses (CWE)

CWE-20Improper Input ValidationPrimary CWE-20Improper Input Validation

CWE-20 — Improper Input Validation: The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

[Architecture and Design] Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses. [REF-1109] [REF-1110] [REF-1111]
[Architecture and Design] Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).

Source: MITRE CWE corpus.