CVE-2026-93841: vLLM OOB write — MEDIUM

CISO Take

vLLM through 0.29.0 has an out-of-bounds write in its Triton penalty bincount kernel. Prompt token IDs equal to the vocabulary size are not bounds-checked, so a remote, unauthenticated user submitting a crafted multimodal audio request can corrupt the sampler state of other concurrent requests and alter their repetition penalty behavior. Impact is limited to integrity of adjacent outputs (CVSS 5.3, no confidentiality or availability impact), there is no public exploit or Nuclei template, CISA SSVC says TRACK and the CVE is not in KEV. EPSS is low in absolute terms (0.00237) but sits in the 86th percentile, so it is not negligible. Multi-tenant vLLM deployments exposed to untrusted users are the main concern, because one tenant can degrade the output quality of others. Upgrade to a release containing the fix from vllm PR 49081, and in the meantime validate token IDs against vocabulary size at your gateway or restrict multimodal audio inputs from untrusted callers.

Sources:NVDEPSSATLASCISA SSVCVulnCheckGitHub

What is the risk?

Medium. Exploitation is network-reachable, needs no privileges or user interaction and is low complexity, but the impact is limited to integrity of other requests' sampling behavior. There is no known public exploit, no KEV listing and SSVC is TRACK. Exposure is highest for shared, multi-tenant or internet-facing vLLM endpoints that accept multimodal audio input. Single-tenant internal deployments carry little practical risk. Memory corruption could, in principle, have effects beyond what is documented, so treat the CVSS as a floor for shared inference infrastructure.

How does the attack unfold?

Initial Access

Attacker sends a multimodal audio request to an exposed vLLM inference endpoint.

AML.T0040

Exploitation

Prompt token IDs equal to vocabulary size cause an out-of-bounds write in the Triton penalty bitset.

AML.T0049

Impact

Sampler state of concurrent requests is corrupted, silently altering their repetition penalty behavior and output integrity.

AML.T0031

Initial Access

Attacker sends a multimodal audio request to an exposed vLLM inference endpoint.

AML.T0040

Exploitation

Prompt token IDs equal to vocabulary size cause an out-of-bounds write in the Triton penalty bitset.

AML.T0049

Impact

Sampler state of concurrent requests is corrupted, silently altering their repetition penalty behavior and output integrity.

AML.T0031

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	—	No patch
96.0K94 dependentsPushed 5d ago27% patched~37d to patchFull package profile →

Do you use vLLM? You're affected.

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 15% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CNone

ILow

ANone

What should I do?

5 steps

Upgrade vLLM to a version that includes the fix from vllm-project/vllm PR 49081 (later than 0.29.0).
Until patched, add input validation at the API gateway or proxy to reject token IDs greater than or equal to the model vocabulary size, and restrict multimodal audio input to authenticated or trusted callers.
Isolate tenants onto separate vLLM instances where output integrity matters.
Rate-limit and authenticate access to inference endpoints.
Detection: monitor for anomalous request patterns with out-of-range token IDs in audio or multimodal requests, unexplained output quality regressions or repetition anomalies, and GPU worker errors or crashes.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoSInferenceFrameworkAML.T0031- Erode AI Model Integrity AML.T0040- AI Model Inference API Access AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responding to previously unknown risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-93841?

vLLM through 0.29.0 has an out-of-bounds write in its Triton penalty bincount kernel. Prompt token IDs equal to the vocabulary size are not bounds-checked, so a remote, unauthenticated user submitting a crafted multimodal audio request can corrupt the sampler state of other concurrent requests and alter their repetition penalty behavior. Impact is limited to integrity of adjacent outputs (CVSS 5.3, no confidentiality or availability impact), there is no public exploit or Nuclei template, CISA SSVC says TRACK and the CVE is not in KEV. EPSS is low in absolute terms (0.00237) but sits in the 86th percentile, so it is not negligible. Multi-tenant vLLM deployments exposed to untrusted users are the main concern, because one tenant can degrade the output quality of others. Upgrade to a release containing the fix from vllm PR 49081, and in the meantime validate token IDs against vocabulary size at your gateway or restrict multimodal audio inputs from untrusted callers.

Is CVE-2026-93841 actively exploited?

No confirmed active exploitation of CVE-2026-93841 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-93841?

1. Upgrade vLLM to a version that includes the fix from vllm-project/vllm PR 49081 (later than 0.29.0). 2. Until patched, add input validation at the API gateway or proxy to reject token IDs greater than or equal to the model vocabulary size, and restrict multimodal audio input to authenticated or trusted callers. 3. Isolate tenants onto separate vLLM instances where output integrity matters. 4. Rate-limit and authenticate access to inference endpoints. 5. Detection: monitor for anomalous request patterns with out-of-range token IDs in audio or multimodal requests, unexplained output quality regressions or repetition anomalies, and GPU worker errors or crashes.

What systems are affected by CVE-2026-93841?

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference, multi-tenant inference platforms, multimodal pipelines.

What is the CVSS score for CVE-2026-93841?

CVE-2026-93841 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.24%.

What is the AI security impact?

Affected AI Architectures

model servingLLM inferencemulti-tenant inference platformsmultimodal pipelines

MITRE ATLAS Techniques

AML.T0031Erode AI Model Integrity

AML.T0040AI Model Inference API Access

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs index the penalty prompt-presence bitset without bounds checking against vocabulary size. Attackers can submit multimodal audio requests with tokens equal to vocabulary size, causing out-of-bounds writes that corrupt concurrent requests' sampler state and alter repetition penalty behavior.

Exploitation Scenario

An attacker finds a shared vLLM endpoint that accepts multimodal audio requests. They submit requests with prompt token IDs equal to the vocabulary size, triggering an out-of-bounds write in the penalty bitset. Because requests are batched together, the write lands in the sampler state of other users' concurrent requests and changes their repetition penalty behavior. The attacker repeats the requests to continuously degrade or manipulate the output quality of other tenants, with no authentication required if the endpoint is exposed.

Weaknesses (CWE)

CWE-129Improper Validation of Array IndexPrimary CWE-129Improper Validation of Array Index

CWE-129 — Improper Validation of Array Index: The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

[Architecture and Design] Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server. Even though client-side checks provide minimal benefits with respect to server-side security, they are still useful. First, they can support intrusion detection. If the server receives input that should have been rejected by the client, then it may be an indication of an attack. Second, client-side error-checking can provide helpful feedback to the user about the expectations for valid input. Third, there may be a reduction in server-side processing time for accidental input errors, although this is typically a small savings.

Source: MITRE CWE corpus.