Vulnerabilities

Security research · CVE-2026-115913

vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine

Published Oct 28, 2026 · catalog updated Oct 28, 2026 · vLLM: Phi-4 multimodal audio

Last checked Nov 4, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-115913. EPSS is 0.33%. Act only if a listed version of vLLM: Phi-4 multimodal audio is installed.

Severity

Medium6.5

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.33%

Remediation

Version ranges on file

Affected products

pip vllm

### Summary The Phi-4 multimodal audio encoder ( / ) runs its conformer attention in **eager mode by default**: the official HF config of does not set , so the default applies ( , ; ). The eager path fully materializes the attention probability matrix of shape per layer — and then **stores it on the module**: ( , a declared at ), keeping a live reference for every one of the 24 encoder layers. The only gates on audio length are the server-side limits and ( ) — i.e. a 10-minute clip is a **legal input by default**. A 600 s clip becomes ~60,000 mel frames, which the encoder unfolds into 500-frame chunks ( , ), giving . Each layer therefore materializes a matrix (~1–2 GiB depending on dtype), and the module attribute keeps all completed layers' matrices alive, so GPU memory climbs monotonically **within a single request** until an allocation fails. Verified end-to-end on the official image: one 19.2 MB silent 600 s WAV → worker inside ( → → ) → → API → whole server down; refuses connections. Total time from request to dead service: **~6 seconds**. A secondary effect: because persists on the module after the request ends, the matrices of the last audio request stay resident indefinitely (observed +50 MiB pinned after a single 5 s control request); they are only overwritten by the next audio request, so the resident footprint equals the largest audio processed since startup. ### Details **1. Root cause.** in eager mode computes and unconditionally executes ( ). The attribute is a leftover inference/debug hook (used by at ); in serving it serves no purpose but pins the full tensor per layer past both the layer's forward and the request's lifetime. The SDP attention branch ( ) never materializes this matrix — but the HF config does not enable it and the code default is . **2. Why one request suffices.** The conformer chunks long audio to frames ( ). Duration is bounded only by , so reaches ~120 for a maximal clip. With 16 heads and fp32 scores, one layer's attention tensor