MediumVulnerabilityCVE-2026-115913updated 28 Oct 2026, 21:16 UTC

vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes…

Fixed in vllm 0.32.0Official source

Severity	MediumCVSS 6.5 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	Yesvllm 0.32.0 · since 28 Oct 2026
How sure is this?	Official sourceBacked by an official source

Are you affected?

Package / product	Affected versions	Fixed in
vllm · pip	< 0.32.0	0.32.0

Timeline

28 Oct 2026, 21:15 UTC
Publicly disclosed
28 Oct 2026, 21:15 UTC
Reported by GitHub Advisory · GitHub Advisory
28 Oct 2026, 21:16 UTC
Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engineGitHub Advisory · 28 Oct 2026, 21:15 UTC

Technical details

ID: CVE-2026-115913 · GHSA-8397-8qf6-f2gm
CVSS: 6.5 / 10
EPSS: 0.3% chance of exploitation within 30 days
Disclosed: 28 Oct 2026, 21:15 UTC
On Zero Radar: 28 Oct 2026, 21:16 UTC (1 min after disclosure)
Last change: 28 Oct 2026, 21:16 UTC

This entry has not been explained yet. The text comes straight from the source. How Zero Radar works

vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes… · Zero Radar