CVE-2026-115913

vLLM Phi-4 audio attention can exhaust GPU memory

vLLM project · vLLM Phi-4 multimodal audio encoder

First documented disclosure · Review checkpoint

Summary

An accepted long audio clip could exhaust GPU memory and stop the serving engine.

Severity and exploitation evidence

Medium · 6.5/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed primary sources document a vulnerability or controlled demonstration, not confirmed malicious exploitation.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Eager attention materialized large matrices and retained them on each encoder layer.

Conditions required

Serving Phi-4 multimodal or a model reusing its audio tower, accepting long audio, and sufficient memory pressure; endpoint access follows deployment authentication.

Potential impact

Engine termination and loss of service to other users.

Affected versions and configurations

Before 0.32.0 per the CNA; end-to-end reproduction used 0.31.0.

Fix and mitigation status

0.32.0.

Practical next steps

Upgrade and bound audio duration; verify the encoder uses the patched attention implementation.

Operating lesson

Resource limits must reflect intermediate model computations, not just upload size.

Evidence and limits

Public October 8 fix discussion predates October 20 advisory and October 26 CVE publication. The demonstration used a legal 10-minute clip on a 24GB GPU; impact depends on memory headroom. No compromise or data theft is reported.

Sources