CVE-2026-115913: vLLM Phi-4 audio attention causes

Q: Is CVE-2026-115913 actively exploited?

No confirmed active exploitation of CVE-2026-115913 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-115913?

1) Upgrade vLLM to 0.32.0 or later (fix in PR 60614 and commit 3d52578). 2) If you cannot patch, cap audio duration and file size at the API gateway or reverse proxy, and reject oversized inputs before they reach the engine. 3) Apply per-user rate limits and concurrency limits on multimodal endpoints. 4) Require authentication on vLLM endpoints and do not expose them directly to the internet. 5) Configure automatic restart and health checks for the serving process to shorten recovery time. 6) Detect abuse by alerting on CUDA OOM errors, EngineCore termination in logs, and unusual spikes in GPU memory after audio requests. 7) Consider isolating multimodal workloads from critical text-only serving.

Q: What systems are affected by CVE-2026-115913?

This vulnerability affects the following AI/ML architecture patterns: Model serving, LLM inference, Multimodal inference pipelines, Multi-tenant inference APIs.

Q: What is the CVSS score for CVE-2026-115913?

CVE-2026-115913 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.33%.

CISO Take

CVE-2026-115913 is a resource-exhaustion flaw in vLLM's Phi-4 multimodal audio encoder, where eager attention materializes quadratic attention matrices for a single long audio clip and can exhaust GPU memory. An authenticated low-privilege user can crash EngineCore and take down inference for every tenant. It's rated medium (CVSS 6.5, availability-only impact), and there is no public exploit, no Nuclei template, no KEV listing and no EPSS data, so mass exploitation looks unlikely today. Exposure matters most for shared or multi-tenant vLLM endpoints that serve Phi-4 multimodal and accept user-supplied audio. Upgrade to vLLM 0.32.0 or later, and until then enforce audio duration and size limits at the gateway and put the service behind authentication and rate limiting.

Sources:NVDGitHub AdvisoryATLASgithub.com/vllm-project/vllm

What is the risk?

Medium. The attack is network-reachable, low complexity and needs only low privileges and no user interaction. Impact is limited to availability (A:H), with no confidentiality or integrity effect. The blast radius is high on shared deployments because one request can terminate EngineCore for all users. Exploitation requires Phi-4 multimodal audio to be enabled and reachable. No public exploit, scanner template or KEV listing exists, and EPSS data is unavailable. Confidence: HIGH on the vulnerability mechanics (vendor advisory and fix commit), LOW on exploitation likelihood (no data).

How does the attack unfold?

Initial Access

Attacker authenticates with a low-privilege account to a network-exposed vLLM endpoint serving Phi-4 multimodal.

AML.T0040

Exploitation

Attacker submits one legal but very long audio clip that triggers eager attention in the audio encoder.

AML.T0034.001

Impact

Quadratic attention matrices exhaust GPU memory, EngineCore terminates, and inference is denied to all users.

AML.T0029

Initial Access

Attacker authenticates with a low-privilege account to a network-exposed vLLM endpoint serving Phi-4 multimodal.

AML.T0040

Exploitation

Attacker submits one legal but very long audio clip that triggers eager attention in the audio encoder.

AML.T0034.001

Impact

Quadratic attention matrices exhaust GPU memory, EngineCore terminates, and inference is denied to all users.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	< 0.32.0	`0.32.0`
95.4K94 dependentsPushed 6d ago27% patched~37d to patchFull package profile →

Do you use vLLM? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

1) Upgrade vLLM to 0.32.0 or later (fix in PR 60614 and commit 3d52578). 2) If you cannot patch, cap audio duration and file size at the API gateway or reverse proxy, and reject oversized inputs before they reach the engine. 3) Apply per-user rate limits and concurrency limits on multimodal endpoints. 4) Require authentication on vLLM endpoints and do not expose them directly to the internet. 5) Configure automatic restart and health checks for the serving process to shorten recovery time. 6) Detect abuse by alerting on CUDA OOM errors, EngineCore termination in logs, and unusual spikes in GPU memory after audio requests. 7) Consider isolating multimodal workloads from critical text-only serving.

How is it classified?

DoSInferenceModelAML.T0029- Denial of AI Service AML.T0034.001- Resource-Intensive Queries AML.T0040- AI Model Inference API Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to unknown risks and resource failures

OWASP LLM Top 10

LLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-115913?

CVE-2026-115913 is a resource-exhaustion flaw in vLLM's Phi-4 multimodal audio encoder, where eager attention materializes quadratic attention matrices for a single long audio clip and can exhaust GPU memory. An authenticated low-privilege user can crash EngineCore and take down inference for every tenant. It's rated medium (CVSS 6.5, availability-only impact), and there is no public exploit, no Nuclei template, no KEV listing and no EPSS data, so mass exploitation looks unlikely today. Exposure matters most for shared or multi-tenant vLLM endpoints that serve Phi-4 multimodal and accept user-supplied audio. Upgrade to vLLM 0.32.0 or later, and until then enforce audio duration and size limits at the gateway and put the service behind authentication and rate limiting.

Is CVE-2026-115913 actively exploited?

No confirmed active exploitation of CVE-2026-115913 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-115913?

1) Upgrade vLLM to 0.32.0 or later (fix in PR 60614 and commit 3d52578). 2) If you cannot patch, cap audio duration and file size at the API gateway or reverse proxy, and reject oversized inputs before they reach the engine. 3) Apply per-user rate limits and concurrency limits on multimodal endpoints. 4) Require authentication on vLLM endpoints and do not expose them directly to the internet. 5) Configure automatic restart and health checks for the serving process to shorten recovery time. 6) Detect abuse by alerting on CUDA OOM errors, EngineCore termination in logs, and unusual spikes in GPU memory after audio requests. 7) Consider isolating multimodal workloads from critical text-only serving.

What systems are affected by CVE-2026-115913?

This vulnerability affects the following AI/ML architecture patterns: Model serving, LLM inference, Multimodal inference pipelines, Multi-tenant inference APIs.

What is the CVSS score for CVE-2026-115913?

CVE-2026-115913 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.33%.

What is the AI security impact?

Affected AI Architectures

Model servingLLM inferenceMultimodal inference pipelinesMulti-tenant inference APIs

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0034.001Resource-Intensive Queries

AML.T0040AI Model Inference API Access

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multimodal audio encoder in phi4mm_audio.py and phi4mm_utils.py uses eager attention by default, allowing a remote client to submit one legal long audio clip that causes MultiHeadedAttention.forward_attention to materialize and retain full attention matrices in self.attn. The scaled dot-product attention branch does not materialize these matrices. The resulting quadratic GPU-memory use can cause an out-of-memory condition and terminate EngineCore for all users. This issue is fixed in version 0.32.0.

Exploitation Scenario

An attacker with a low-privilege account or API key for a shared vLLM deployment serving Phi-4 multimodal submits a single, valid but very long audio clip through the chat or transcription endpoint. The audio encoder's eager attention allocates and retains quadratic attention matrices, GPU memory is exhausted, and EngineCore terminates. All tenants lose inference service until the process is restarted, and the attacker can repeat the request to keep the service down.

Weaknesses (CWE)

CWE-770Allocation of Resources Without Limits or ThrottlingPrimary CWE-770Allocation of Resources Without Limits or ThrottlingPrimary CWE-770Allocation of Resources Without Limits or Throttling

CWE-770 — Allocation of Resources Without Limits or Throttling: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

[Requirements] Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
[Architecture and Design] Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

Source: MITRE CWE corpus.