CVE-2026-93841: vLLM Buffer Overflow Vulnerability

CVE-2026-93841 Overview

CVE-2026-93841 is a memory corruption vulnerability affecting vLLM through version 0.29.0. The flaw resides in the Triton _bincount_kernel, where prompt token IDs index the penalty prompt-presence bitset without bounds checking against vocabulary size. Attackers submitting multimodal audio requests with tokens equal to vocabulary size trigger out-of-bounds writes. These writes corrupt the sampler state of concurrent requests and alter repetition penalty behavior. The vulnerability is classified under CWE-129: Improper Validation of Array Index and impacts multi-tenant vLLM inference deployments.

Critical Impact
Adjacent requests processed on the same vLLM worker can have their sampler state silently corrupted, producing altered model outputs without any error signal to affected clients.

Affected Products

vLLM through version 0.29.0
vLLM Triton _bincount_kernel in vllm/v1/worker/gpu/sample/penalties.py
Multi-tenant vLLM deployments serving multimodal audio requests

Discovery Timeline

2026-09-18 - CVE-2026-93841 published to the National Vulnerability Database
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93841

Vulnerability Analysis

vLLM is a high-throughput inference and serving engine for large language models. The vulnerability lives in the sampler's repetition-penalty computation, which uses a Triton kernel named _bincount_kernel to build a prompt-presence bitset indexed by token ID. The kernel assumes every prompt token ID falls within [0, vocab_size), but this invariant is not enforced for tokens produced by multimodal audio ingestion. When a request contains a token ID equal to vocab_size, the kernel writes one slot past the end of the bitset. Because vLLM batches concurrent requests into shared GPU memory, the stray write lands inside another tenant's sampler state and modifies its repetition-penalty behavior. Impact is limited to integrity of model outputs; confidentiality and availability are not directly affected.

Root Cause

The root cause is missing validation of prompt token IDs against vocab_size prior to indexing the penalty bitset in _bincount_kernel. The relevant logic in vllm/v1/worker/gpu/sample/penalties.py trusts caller-supplied token IDs. Multimodal audio pipelines can emit boundary tokens equal to vocab_size, satisfying the CWE-129 pattern of an unvalidated array index.

Attack Vector

An unauthenticated attacker with network access to a vLLM inference endpoint submits a crafted multimodal audio request containing prompt token IDs equal to vocab_size. Processing the request executes the out-of-bounds write in the Triton kernel. The corruption modifies the repetition-penalty state of a concurrent, unrelated request being sampled on the same GPU worker. The victim request receives altered generations without observable error. Exploitation requires the target deployment to serve multimodal audio and to batch requests across tenants, which corresponds to the Attack Requirement (AT:P) metric.

The vulnerability is described in prose because no verified proof-of-concept exists. See the VulnCheck Security Advisory for vLLM and the upstream fix in vLLM Pull Request #49081 for technical details.

Detection Methods for CVE-2026-93841

Indicators of Compromise

Multimodal audio requests submitted to vLLM endpoints containing prompt token IDs equal to or greater than the model's configured vocab_size.
Unexpected divergence in generated output for deterministic requests (same prompt, same seed) served by a shared vLLM worker.
Requests hitting the penalties.py code path with abnormal token-ID distributions logged near the tail of the vocabulary range.

Detection Strategies

Instrument vLLM ingestion to validate every prompt token ID against vocab_size and log or reject out-of-range values before they reach the sampler.
Compare vLLM binaries and package versions against 0.29.0 and earlier across the fleet using software composition analysis.
Add integration tests that send multimodal audio requests with boundary token IDs and assert that concurrent requests remain unaffected.

Monitoring Recommendations

Alert on any vLLM process running a vulnerable release exposed to untrusted or multi-tenant traffic.
Monitor inference API access logs for anomalous multimodal audio submissions from unauthenticated or low-reputation sources.
Track model-output drift and repetition-penalty metrics per tenant to surface silent corruption events.

How to Mitigate CVE-2026-93841

Immediate Actions Required

Inventory all vLLM deployments and identify instances running version 0.29.0 or earlier.
Upgrade to a vLLM release that incorporates the fix from vLLM Pull Request #49081.
Restrict multimodal audio inference to authenticated tenants until the patch is applied.

Patch Information

The upstream fix is tracked in vLLM Pull Request #49081, which adds bounds checking so prompt token IDs greater than or equal to vocab_size no longer index the penalty bitset. Consult the vLLM project repository for the release incorporating this patch and follow the project's upgrade guidance for production deployments.

Workarounds

Disable multimodal audio input paths on vulnerable vLLM workers until upgrade is completed.
Deploy an ingress-layer validator that rejects requests whose prompt token IDs fall outside [0, vocab_size).
Isolate tenants onto dedicated vLLM workers to prevent cross-request sampler state corruption during the remediation window.

bash

# Configuration example: upgrade vLLM past the vulnerable 0.29.0 release
pip install --upgrade "vllm>0.29.0"

# Verify the installed version
python -c "import vllm; print(vllm.__version__)"