Offensive Testing
Penetration TestingVulnerability AssessmentsRed Team Engagements
Advisory & Research
AI Launch Risk ReviewSecurity Architecture ReviewSecurity ResearchSecurity Awareness Training
Software
Breachwright
Community
AI Security DatabaseAdvent Prompt PwnField Manual
ResearchAboutContact
Get in Touch
← Back to the database
high · 8.8Maintainer reviewedAASD-2025-0003

vLLM prompt-embedding deserialization permits memory corruption

vLLM before 0.11.1 loaded user-supplied prompt embeddings through torch.load without sufficient validation. Crafted sparse tensors could bypass integrity checks and trigger an out-of-bounds write during conversion to a dense tensor, causing a crash and potentially code execution in the inference server.

Prerequisites

  • The prompt-embeddings feature is enabled and reachable by an attacker with API access

Potential impact

  • Inference-server crash through out-of-bounds memory write
  • Potential code execution in the vLLM server context

Mitigations

  • Upgrade vLLM to version 0.11.1 or later
  • Disable or restrict prompt-embedding inputs and do not accept serialized tensors from untrusted clients

Public sources

cve recordvendor advisorypatch

Research note

Potential code execution is stated by the public advisory; the record does not include exploit material.