CVE-2026-73558

[CVE catalog]

Severity

Medium · CVSS 5.3CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Published

Aug 10, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.41% · Oct 25, 2026

A flaw was found in vLLM, an inference and serving engine for large language models. An integer overflow vulnerability in the `act_and_mul_kernel` kernel allows a remote attacker to cause cross-user data leakage. By crafting specific requests processed in the same inference batch, an attacker can obtain a partial or complete copy of another user's inference result. This could lead to the unauthorized disclosure of sensitive information. vllm: vLLM: Cross-User Data Leakage via Integer Overflow This Moderate flaw in vLLM, an inference engine for large language models, can lead to cross-user data leakage. An integer overflow during batched inference may allow one user's request to inadvertently receive partial or complete inference results from another user within the same batch. This is particularly relevant in multi-tenant environments where vLLM processes requests concurrently from different users. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.