CVE-2026-115913

What it actually does

The flaw forces eager attention in the Phi-4 multimodal audio encoder, causing MultiHeadedAttention.forward_attention to allocate and retain full quadratic-sized attention matrices in GPU memory instead of using the scaled dot-product path that avoids materialization.

Why it matters to the business

A single remote request can exhaust GPU memory and terminate the shared inference engine, halting all model serving for every user until the process is restarted.

How an attack unfolds

An attacker with low-privileged API access submits one legal but lengthy audio clip to the multimodal endpoint; because the encoder defaults to eager attention, the engine materializes the full attention matrices, triggering an out-of-memory condition that crashes EngineCore for the entire deployment.

How to fix it

Upgrade vLLM to version 0.32.0 or later; the fix routes Phi-4 audio processing through the scaled dot-product attention branch that never materializes the full matrices.

How to confirm the fix worked

Confirm the installed vLLM package version is 0.32.0 or newer; replay long audio inputs against the phi4mm_audio path and verify that GPU memory usage remains linear rather than quadratic.

Typical attack path

1. Obtain network access to a vLLM multimodal inference endpoint
2. Submit a single long audio clip via the Phi-4 audio path
3. Trigger eager-attention materialization of full attention matrices
4. Exhaust GPU memory and terminate EngineCore for all tenants

How to detect it

Search engine logs and container output for out-of-memory exceptions originating from phi4mm_audio.py or phi4mm_utils.py, GPU memory exhaustion events, and abrupt EngineCore termination shortly after audio-processing requests.

What your security team should do

• Upgrade to vLLM 0.32.0 immediately given the public exploit availability
• Temporarily disable or heavily rate-limit multimodal audio endpoints until patched
• Add memory-usage alerts on inference workers to detect anomalous spikes