CVE-2026-109311

vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow. Authenticated remote attackers can repeatedly upload malformed IAMF containers to /v1/audio/transcriptions, corrupting the heap and crashing the A...

CVE-2026-109311 vLLM before 0.29.0 Heap Overflow DoS via IAMF Audio Transcription Upload

vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow. Authenticated remote attackers can repeatedly upload malformed IAMF containers to /v1/audio/transcriptions, corrupting the heap and crashing the A...

PT-2026-110728

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.29.0 Description The software passes uploaded audio to the PyAV/FFmpeg av.open fallback using only a file-size check, which exposes a heap overflow in the FFmpeg IAMF parser. Authenticated remote attackers can exploit...