CVE-2026-34760 Details

A vulnerability exists in vLLM, an inference engine for large language models, in versions 0.5.5 prior to 0.18.0. The issue arises from vLLM's reliance on Librosa for audio processing, where Librosa's default method for downmixing stereo to mono audio does not comply with the international standard ITU-R BS.775-4. This misalignment can cause discrepancies between audio as perceived by humans and how it is interpreted by AI models, potentially leading to degraded performance in tasks such as speech recognition. The vulnerability can be exploited by embedding interference signals or hidden content in the low-frequency effects (LFE) channel of multichannel audio files. When these files are played on devices that disregard the LFE channel, only the normal content is audible. However, AI systems processing the audio with Librosa can pick up the LFE interference, disrupting speech recognition accuracy or masking critical detection features. This exploitation could bypass AI content moderation, voice authentication systems, or cause incorrect transcriptions.

Users can update to vLLM version 0.18.0 or later, where this vulnerability has been addressed.