CVE-2026-109311: vLLM Buffer Overflow Vulnerability

CVE-2026-109311 Overview

CVE-2026-109311 affects vLLM versions prior to 0.29.0. The vulnerability stems from unsafe handling of user-supplied audio in the /v1/audio/transcriptions endpoint. vLLM passes uploaded audio to the PyAV/FFmpeg av.open() fallback after only a file-size check. This exposes FFmpeg's Immersive Audio Model and Formats (IAMF) parser, which contains a heap overflow. Authenticated remote attackers can upload malformed IAMF containers to corrupt the heap and crash the API process. The flaw is classified as improper input validation [CWE-20].

Critical Impact
Authenticated attackers can crash the vLLM inference server by repeatedly uploading malformed IAMF audio files, producing a sustained denial of service against hosted model APIs.

Affected Products

vLLM versions prior to 0.29.0
vLLM deployments exposing /v1/audio/transcriptions to authenticated users
Environments relying on PyAV/FFmpeg av.open() fallback decoding

Discovery Timeline

2026-10-12 - CVE-2026-109311 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-109311

Vulnerability Analysis

vLLM accepts audio uploads at the /v1/audio/transcriptions endpoint for speech-to-text workloads. When the primary decoder rejects or cannot interpret a file, vLLM falls back to PyAV's av.open(), which wraps FFmpeg's demuxers and parsers. Before invoking the fallback, vLLM applies only a file-size validation. It does not inspect the container format or restrict codec families. This permits an attacker to deliver an IAMF container that FFmpeg's IAMF parser mishandles, triggering a heap buffer overflow inside the FFmpeg library.

The overflow corrupts heap memory in the vLLM worker process. In practice, this causes the API process to crash, interrupting all in-flight inference requests. Repeated uploads sustain the denial-of-service condition. Because the parser is reached without format allowlisting, any authenticated client with transcription privileges can trigger the condition.

Root Cause

The root cause is improper input validation [CWE-20]. vLLM delegates untrusted bytes to a broad multimedia parser without constraining container, codec, or structural properties. The upstream heap overflow resides in FFmpeg's IAMF parser, but vLLM amplifies exposure by exposing that parser to authenticated network input.

Attack Vector

The attack vector is network-based and requires low privileges. An authenticated user issues an HTTP POST to /v1/audio/transcriptions with a crafted IAMF container that passes the size check. The server routes the payload to av.open(), which invokes the vulnerable FFmpeg IAMF parsing path. The resulting heap corruption terminates the API process. See the GitHub Security Advisory GHSA-m52c-39rh-f3gp and the VulnCheck Advisory for VLLM Heap Overflow for the full technical description.

Detection Methods for CVE-2026-109311

Indicators of Compromise

Repeated HTTP POST requests to /v1/audio/transcriptions from a single authenticated identity.
Uploads whose magic bytes or container headers indicate IAMF format submitted to a transcription endpoint.
Unexpected worker-process crashes or SIGSEGV/SIGABRT signals in vLLM logs following audio uploads.
Spikes in 5xx responses or API restarts correlated with audio upload traffic.

Detection Strategies

Inspect reverse-proxy and application logs for sequences of transcription requests immediately preceding process restarts.
Instrument the vLLM process with crash reporting to capture heap corruption signatures from FFmpeg frames.
Alert when the vLLM worker restart counter increases outside normal deployment windows.

Monitoring Recommendations

Monitor per-user request rates to /v1/audio/transcriptions and threshold on abnormal volumes.
Track FFmpeg and PyAV versions on hosts running vLLM to confirm patched runtimes.
Forward API gateway logs and container runtime events to a centralized analytics platform for correlation with crash telemetry.

How to Mitigate CVE-2026-109311

Immediate Actions Required

Upgrade vLLM to version 0.29.0 or later on all hosts exposing audio transcription.
Restrict access to /v1/audio/transcriptions to trusted service accounts until the upgrade is complete.
Rotate API tokens for any identity suspected of submitting malformed IAMF payloads.
Review FFmpeg and PyAV versions and patch the underlying libraries to current releases.

Patch Information

The vLLM project resolved the issue in release 0.29.0. Refer to the GitHub Security Advisory GHSA-m52c-39rh-f3gp for commit references and upgrade guidance.

Workarounds

Disable the audio transcription endpoint if it is not required for production workloads.
Enforce an allowlist of audio container formats at an upstream proxy and reject IAMF uploads.
Place the transcription endpoint behind authentication tiers that limit it to vetted internal services.
Apply strict request rate limits per authenticated principal to slow repeated crash attempts.

bash

# Configuration example: upgrade vLLM and restrict endpoint exposure
pip install --upgrade "vllm>=0.29.0"

# Example NGINX rule to block the vulnerable endpoint until patched
# location = /v1/audio/transcriptions {
#     return 403;
# }