CVE-2025-62164

The record

A memory corruption vulnerability that leading to a crash (denial-of-service) and potentially remote code execution (RCE) exists in vLLM versions 0.10.2 and later, in the Completions API endpoint. When processing user-supplied prompt embeddings, the endpoint loads serialized tensors using torch.load() without sufficient validation. Due to a change introduced in PyTorch 2.8.0, sparse tensor integrity checks are disabled by default. As a result, maliciously crafted tensors can bypass internal bounds checks and trigger an out-of-bounds memory write during the call to to_dense(). This memory corruption can crash vLLM and potentially lead to code execution on the server hosting vLLM.

Affected packages

Related vulnerabilities

• GHSA-mrw7-hf4f-83pf vLLM deserialization vulnerability leading to DoS and potential RCE Same vulnerability
• CVE-2026-22778 vLLM is an inference and serving engine for large language models (LLMs). Also affects vllm
• GHSA-4r2x-xpjr-7cvv vLLM has RCE In Video Processing Also affects vllm
• GHSA-qh4c-xf7m-gxfc vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector Also affects vllm
• CVE-2026-24779 vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector Also affects vllm
• GHSA-2pc9-4j83-qjmr vLLM affected by RCE via auto_map dynamic module loading during model initialization Also affects vllm
• CVE-2026-22807 vLLM affected by RCE via auto_map dynamic module loading during model initialization Also affects vllm
• GHSA-grg2-63fw-f2qr vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous… Also affects vllm