Introduction
A single malformed API request can crash a production LLM inference server or potentially allow remote code execution on the host. CVE-2025-62164 is a critical memory corruption vulnerability in vLLM, a widely used open-source engine for serving large language models. It affects organizations running vLLM versions 0.10.2 through 0.11.0 with the Completions API exposed.
About vLLM: vLLM is a high-performance inference and serving engine for large language models, adopted by research labs and industry for its throughput and efficiency. A large open-source community maintains the project, and it became a PyTorch Foundation project in 2025.
Technical Information
The vulnerability triggers when the vLLM Completions API endpoint receives user-supplied prompt embeddings as serialized PyTorch tensors. vLLM deserializes these tensors with torch.load() without sufficient validation. Starting with PyTorch 2.8.0, sparse tensor integrity checks are disabled by default, so malformed tensors with corrupted index arrays can bypass validation.
When vLLM calls .to_dense() on such a tensor, PyTorch dereferences attacker-controlled index arrays. If these indices are out of bounds, the operation writes outside the allocated buffer and corrupts memory. This can crash the vLLM process (denial of service), and it may allow remote code execution if the attacker can control the overwritten memory.
The attack requires only network access to the Completions API endpoint, which does not require authentication by default. An attacker crafts a malicious sparse tensor, serializes it with torch.save(), base64-encodes the result, and submits it as the prompt_embeds parameter in an API request. The vulnerability is classified under:
- CWE-20: Improper Input Validation
- CWE-123: Write-what-where Condition
- CWE-502: Deserialization of Untrusted Data
- CWE-787: Out-of-bounds Write
Root Cause:
- vLLM accepts serialized tensor input from untrusted sources through the API
- vLLM calls torch.load() without validating tensor structure or indices
- PyTorch 2.8.0 disables sparse tensor integrity checks by default
- Malicious tensors can trigger out-of-bounds writes during to_dense()
Affected Systems and Versions
- vLLM versions 0.10.2 through 0.11.0 are affected
- Only configurations that expose the Completions API endpoint with prompt embedding support are vulnerable
- The vulnerability is present when running with PyTorch 2.8.0 or later, because those versions disable the integrity checks by default
Vendor Security History
- vLLM has previously fixed security issues such as HTTP header injection and unsafe eval() usage through timely point releases (see v0.10.1.1)
- The project publishes security advisories promptly and ships patches quickly
- Its handling of vulnerability disclosure and remediation is mature
