Junglewise Threat Intelligence

CVE-2026-56340: vLLM improper input validation in multimodal embeddings

CVE-2026-56340 · Severity: high · CVSS 8.8 · Published 2026-06-20

Technologies: vLLM Project vllm. Vendors: PyPI, vLLM Project.

Executive brief

vLLM is a large language model serving framework that processes embeddings for multimodal AI models. When the prompt-embeds feature is enabled, the system fails to validate tensor indices, allowing attackers to send malformed embedding requests that crash the service or corrupt memory, potentially leading to data breach or arbitrary code execution.

Technical details

The vulnerability stems from missing validation of sparse tensor indices in vLLM's multimodal embedding processor. PyTorch (~v2.0) disables sparse tensor invariant checks by default for performance reasons, so vLLM must explicitly validate that tensor indices are valid, non-negative, and within bounds. An attacker with network access and low privileges can craft embedding requests containing negative or out-of-bounds tensor indices that bypass input validation. When the prompt-embeds feature is enabled, this triggers out-of-bounds write operations (CWE-787/CWE-123), causing crashes (DoS), resource exhaustion, or potentially arbitrary code execution via memory corruption. This is a follow-up to CVE-2025-62164, whose initial fix only disabled the feature by default rather than addressing the root cause. Patches are available in version 0.13.0 and later via PR #30649.

Affected products

  • vllm-project vLLM 0.10.2 to 0.12.x (patched in 0.13.0)

Timeline

  • 2026-01-08: disclosed: Published in GitHub Advisory Database
  • 2026-01-08: patched: Fixed in vLLM 0.13.0 via PR #30649

References

Related threats