CVE-2026-73558

Katalog CVE

CVSS 5.3 · Medium EPSS 0,41%

Kerentanan Integer Overflow or Wraparound pada vllm. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x * 2 * d in activation_kernels.cu can cause act_and_mul_kernel to consume another batched user's input, allowing a request processed in the same inference batch to receive a partial or complete copy of another user's inference result. This issue is fixed in version 0.27.0.

Rincian

Terbit di NVD

13 Agustus 2026

Terakhir diubah

28 September 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-190: Integer Overflow or Wraparound

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vllm-project/vllm/security/advisories/GHSA-7m6h-x95x-82q5 exploit · advisory vendor
• https://github.com/vllm-project/vllm/commit/451227cb3ff07989698fed982c2d3e4300257924 patch
• https://github.com/vllm-project/vllm/issues/42860 issue tracking · patch
• https://github.com/vllm-project/vllm/pull/49660 issue tracking · patch
• https://github.com/vllm-project/vllm/releases/tag/v0.27.0 release notes