CVE-2026-34760

[CVE catalog]

Severity

Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Published

Apr 2, 2026, 6:59:49 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.27% · Oct 25, 2026

A flaw was found in Librosa, a software library used by artificial intelligence (AI) models like vLLM for processing audio. The library's method for converting stereo audio to mono differs from international standards, causing AI models to interpret audio differently than humans. This inconsistency could allow an attacker to provide specially crafted audio, leading to the AI model processing the data incorrectly. This could result in a high impact on the integrity of the AI system's operations. vLLM: Librosa: numpy: Librosa: AI model data integrity impact due to audio processing discrepancy The vLLM inference and serving engine for LLM models uses a flawed version of librosa, which downmix audios to mono while international standards mandates it should be used a weight downmixing algorithm. When vLLM is processing an audio file this may result in discrepancy between what's processed by the AI model being served and what humans are able to hear. An attacker may leverage that by crafting a multichannel audio tracker with Low-Frequency Effects interference, hiding content that cannot be heard by the user but may mask critical audio features that are essential to speech recognition. This may result in integrity or safety issues as it may eventually by-pass content moderation or voice recognition based authentication systems. Red Hat Product Security team has rated this vulnerability as having a Moderate security impact, as crafting a valid malicious audio file is considered a high complexity task. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.