CVE-2026-73558 vllm-project CVE debrief

Who should care

Defenders responsible for deploying and managing vLLM should assess exposure and prioritize verification of inference result integrity. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure the security and integrity of inference results in vLLM deployments prior to version 0.27.0.

Why it matters

CVE-2026-73558 integer overflow issue in vLLM prior to 0.27.0 could allow unauthorized access to inference results; defenders should prioritize verifying exposure and assessing inference result integrity.

• Potential unauthorized access to inference results
• Need to verify exposure in vLLM deployments prior to version 0.27.0
• Requires assessment of inference batch result integrity

Technical summary

An integer overflow issue in vLLM prior to version 0.27.0 could allow a request processed in the same inference batch to receive a partial or complete copy of another user's inference result. This issue is caused by an integer overflow in blockIdx.x * 2 * d in activation_kernels.cu, which can cause act_and_mul_kernel to consume another batched user's input. The issue is fixed in version 0.27.0 and defenders should prioritize verifying exposure in vLLM deployments prior to version 0.27.0 and assessing the integrity of inference results.

Defensive priority

Defenders should prioritize verifying exposure in vLLM deployments prior to version 0.27.0 and assessing the integrity of inference results.

Recommended defensive actions

• Verify vLLM deployments for version 0.27.0 or later
• Assess the integrity of inference results in affected versions
• Implement compensating controls to monitor and track inference batch results
• Review and update incident response plans to address potential unauthorized access to inference results
• Conduct a thorough review of vLLM configurations and deployments to identify potential exposure
• Develop and implement additional monitoring and logging to detect potential exploitation attempts
• technicalSummary

Evidence notes

The CVE record and NVD entry provide details on an integer overflow issue in vLLM prior to version 0.27.0, which could allow a request processed in the same inference batch to receive a partial or complete copy of another user's inference result.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.