Is CVE-2026-109311 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109311?

CVE-2026-109311 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-109311

Description

vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow. Authenticated remote attackers can repeatedly upload malformed IAMF containers to /v1/audio/transcriptions, corrupting the heap and crashing the API process.