CVE-2026-115913

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.32.0

Description The Phi-4 multimodal audio encoder in phi4mm audio.py and phi4mm utils.py uses eager attention by default. This allows a remote client to submit a long audio clip that triggers the MultiHeadedAttention.forward attention() function to materialize and retain full attention matrices in self.attn. Unlike the scaled dot-product attention branch, this process results in quadratic GPU-memory consumption, which can lead to an out-of-memory condition and terminate the EngineCore for all users.

Recommendations Update vLLM to version 0.32.0.