CVE-2026-93841 in vLLM
Summary
by MITRE • 09/18/2026
vLLM through 0.29.0 contains a memory corruption vulnerability in the Triton _bincount_kernel where prompt token IDs index the penalty prompt-presence bitset without bounds checking against vocabulary size. Attackers can submit multimodal audio requests with tokens equal to vocabulary size, causing out-of-bounds writes that corrupt concurrent requests' sampler state and alter repetition penalty behavior.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in vLLM versions through 0.29.0 represents a critical memory corruption flaw located within the Triton _bincount_kernel implementation. This kernel is responsible for processing token counts during inference, specifically handling penalties such as presence and frequency to influence model output diversity. The core technical defect arises from an absence of bounds checking when prompt token IDs are used to index into the penalty prompt-presence bitset. In a correctly secured system, any access to this data structure must verify that the provided token ID is strictly less than the defined vocabulary size. However, in this vulnerable implementation, the code proceeds with memory writes based on the raw token value without validating it against the upper limit of acceptable indices. This oversight allows an attacker who can control or influence the input tokens to trigger out-of-bounds write operations into adjacent memory regions that are not intended for modification by this specific kernel operation.
The operational impact of this vulnerability is severe, particularly in environments where vLLM serves multiple concurrent requests. When an attacker submits a multimodal audio request containing token IDs equal to or exceeding the vocabulary size, the out-of-bounds write corrupts the sampler state associated with other active inference sessions running on the same GPU context. This corruption alters the repetition penalty behavior for these legitimate users, potentially causing them to receive garbled outputs, experience infinite loops in text generation, or suffer from degraded performance due to unstable sampling parameters. Beyond functional disruption, memory corruption vulnerabilities of this nature can sometimes be leveraged to achieve arbitrary code execution if an attacker can carefully craft inputs to overwrite function pointers or control flow data structures within the GPU kernel's shared memory space, although the primary observed impact is state corruption affecting service reliability and output integrity.
From a classification perspective, this vulnerability aligns with CWE-787: Out-of-bounds Write, as it involves writing data beyond the intended buffer boundary due to insufficient validation of input values. It also relates to CWE-125: Out-of-bounds Read if adjacent reads are affected by the corrupted state, and potentially CWE-400: Uncontrolled Resource Consumption if the corruption leads to excessive GPU utilization or hangs during subsequent inference steps. In terms of adversary tactics, this flaw could be exploited within the MITRE ATT&CK framework under techniques such as T1562: Impair Defenses, by disrupting security monitoring outputs through corrupted model states, or more broadly under privilege escalation vectors if the memory corruption allows for control over the execution context on the accelerator hardware.
Mitigation strategies should prioritize immediate patching to vLLM version 0.30.0 or later, where this bounds checking logic has been corrected. For organizations unable to upgrade immediately, deploying a web application firewall with strict input validation rules can help filter out requests containing token IDs that exceed known vocabulary limits before they reach the inference engine. Additionally, implementing network segmentation to isolate vLLM instances from untrusted user inputs and enforcing least-privilege principles for GPU resource allocation can reduce the blast radius of such exploits. Regular security audits focusing on kernel-level memory access patterns in deep learning frameworks are essential to prevent similar out-of-bounds errors that compromise both confidentiality and integrity of AI inference services.