Description

vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow. Authenticated remote attackers can repeatedly upload malformed IAMF containers to /v1/audio/transcriptions, corrupting the heap and crashing the API process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-10-12T17:17:25.730Z",
  "pubdate": "2026-10-12T17:17:25.730Z",
  "executiveSummary": "vLLM versions prior to 0.29.0 contain a critical vulnerability in the handling of uploaded audio files processed through the /v1/audio/transcriptions endpoint.\nThe vulnerability is identified as a heap overflow triggered within the underlying FFmpeg IAMF (Immersive Audio Model and Formats) parser.\nBy passing user-supplied audio files directly to the PyAV/FFmpeg av.open() function with insufficient validation beyond simple file-size checks, the application exposes internal memory management to malformed media containers.\nThis vulnerability is exploitable by authenticated remote attackers capable of interacting with the audio transcription API.\nSuccessful exploitation results in heap corruption, which allows for service disruption via process crashes (Denial of Service).\nGiven that vLLM services are often deployed in high-availability environments, the ability to repeatedly crash the API process presents a significant stability and availability risk.\nNo complex exploitation chain is required beyond the submission of a maliciously crafted IAMF container, making it a highly accessible vector for malicious actors with authorized access.",
  "technicalDetails": "The vulnerability resides in the integration between the vLLM audio processing pipeline and the third-party PyAV library, which acts as a Python wrapper for FFmpeg. The /v1/audio/transcriptions endpoint facilitates audio uploads which are subsequently routed to the av.open() function.\nThe root cause is an inadequate input validation mechanism. While the application implements a file-size limitation, it fails to perform deep content inspection or sanitization on the uploaded media containers. Consequently, malicious IAMF-encoded audio files reach the underlying FFmpeg decoder.\nFFmpeg's IAMF parser contains a memory corruption flaw, specifically a heap-based buffer overflow, when processing malformed or specifically crafted metadata structures within the IAMF container format.\nThe attack flow proceeds as follows: An authenticated attacker submits a request to the /v1/audio/transcriptions endpoint, attaching a malformed IAMF file designed to trigger the overflow during the parsing phase. The vLLM service receives the request and proceeds to invoke av.open(), passing the file pointer directly to the vulnerable FFmpeg parser. Upon encountering the malformed IAMF structures, the parser fails to properly constrain memory allocation or write boundaries, causing data to overwrite adjacent heap objects.\nBecause the heap structure is corrupted during the parsing routine, the integrity of the process memory space is compromised. This typically leads to an unrecoverable segmentation fault or similar memory violation, resulting in the termination of the vLLM API process.\nThe vulnerability is present in all vLLM versions before 0.29.0. It requires the attacker to have authentication to the vLLM instance to reach the transcription endpoint. The impact is primarily restricted to Denial of Service (DoS) due to the process crashing; however, such flaws can often serve as primitives for more advanced exploitation targeting process memory, depending on the heap layout and the specific nature of the overwrite.\nThe lack of architectural separation between the file ingestion interface and the complex media parsing logic constitutes a significant security regression in the handling of external data, particularly when utilizing libraries that are known to have high complexity and historical susceptibility to memory safety issues."
}