CVE-2026-109311

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.29.0

Description The software passes uploaded audio to the PyAV/FFmpeg av.open() fallback using only a file-size check, which exposes a heap overflow in the FFmpeg IAMF parser. Authenticated remote attackers can exploit this by repeatedly uploading malformed IAMF containers to the '/v1/audio/transcriptions' endpoint, leading to heap corruption and crashing the API process.

Recommendations Update vLLM to version 0.29.0 or later.