CVE-2025-62164

CVE-2025-62164 describes a critical memory corruption vulnerability in vLLM versions 0.10.2 through 0.11.0, specifically within its Completions API endpoint. This flaw allows an attacker to trigger an out-of-bounds memory write by supplying maliciously crafted prompt embeddings, leveraging a change in PyTorch 2.8.0 that disables sparse tensor integrity checks. The vulnerability carries a high CVSS score of 8.8, indicating it can be exploited remotely with low complexity and no user interaction, potentially leading to denial-of-service or remote code execution. While no active exploitation or public exploit code has been observed, and community discussion is minimal, the high FAUCET Risk Score of 83/100 suggests significant potential impact. The issue has been patched in vLLM version 0.11.1.