vLLM Flaw Allows Remote Code Execution Through Malicious Payloads

A high security vulnerability has been discovered in vLLM, a widely used high-throughput inference and serving engine for Large Language Models.

The flaw, identified as CVE-2025-62164, enables attackers to execute arbitrary code remotely through maliciously crafted payloads sent to the Completions API endpoint.

Attribute	Details
CVE ID	CVE-2025-62164
Severity	High
CVSS Score	8.8/10
Affected Product	vLLM (pip)
Affected Versions	≥ 0.10.2

Memory Corruption Vulnerability Threatens vLLM Deployments.

The vulnerability affects vLLM versions 0.10.2 and later, stemming from improper handling of user-supplied prompt embeddings.

When processing these embeddings, the system deserializes tensors using PyTorch’s torch.load() function without adequate validation checks.

This oversight creates a dangerous attack vector that malicious actors can exploit.

The root cause lies in a behavioral change introduced in PyTorch 2.8.0, which disabled sparse tensor integrity checks by default.

This configuration allows attackers to craft malicious tensors that bypass internal bounds checks.

When these compromised tensors are processed by the to_dense() function, they trigger an out-of-bounds memory write, corrupting the application’s memory space.

Security researchers from AXION Security Research Team, specifically Omri Fainaro and Bary Levy, discovered this vulnerability through coordinated disclosure efforts.

Their findings reveal that any user with API access can exploit this weakness to achieve two significant impacts: denial-of-service attacks that crash the vLLM server and remote code execution that compromises the entire hosting environment.

The vulnerability resides in the _load_and_validate_embed function within vllm/entrypoints/renderer.py, where the missing validation allows unsafe deserialization of untrusted input.

The function accepts base64-encoded tensors from users but fails to enable PyTorch’s torch sparse.check_sparse_tensor_invariants context manager, which would usually prevent such attacks.

The Common Vulnerability Scoring System assigns this flaw a score of 8.8 out of 10, classifying it as high severity.

The vulnerability encompasses multiple weakness categories, including improper input validation, deserialization of untrusted data, write-what-where conditions, and out-of-bounds write operations.

The vLLM development team has addressed this security issue through pull request #27204, which implements proper tensor validation before deserialization.

Organizations running vLLM as a server or processing untrusted model-provided payloads should immediately apply the available patch to protect their deployments from potential exploitation.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and set GBH as a Preferred Source in Google.