5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-53923

CVE-2026-53923: vLLM GGUF Kernels: int64_t to int truncation of tensor dimensions causes GPU buffer overflow

vLLM is an inference and serving engine for large language models (LLMs). From 0.5.5 until 0.23.1rc0, integer truncation of tensor dimensions in vLLM's GGUF dequantize kernels (csrc/quantization/gguf/gguf_kernel.cu) causes partial tensor processing. The output tensor is allocated at full size via torch::empty (uninitialized memory), but the dequantize CUDA kernel processes only a truncated number of elements. The unfilled portion of the output tensor retains whatever was previously in GPU memory. In multi-tenant inference deployments, this residual GPU memory may contain tensor data from other users' inference requests, constituting information disclosure. This vulnerability is fixed in 0.23.1rc0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-53923

CVE-2026-53923:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
vllm	pip	>= 0.5.5, <= 0.23.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an information disclosure flaw in vLLM's GGUF dequantization process caused by an integer truncation. Several functions within csrc/libtorch_stable/quantization/gguf/gguf_kernel.cu are responsible for handling model weights. These functions allocate output tensors using torch::stable::empty, which creates buffers without initializing their contents. The number of elements to be processed, calculated from tensor dimensions, was stored in a 32-bit signed integer (int). When a model with very large tensor dimensions (product exceeding 2,147,483,647) was processed, this integer would overflow and truncate. Consequently, the CUDA dequantization kernels would only operate on a fraction of the allocated tensor. The remaining portion of the tensor would retain whatever data was previously in that GPU memory location. In a multi-tenant environment, this stale data could be sensitive information from another user's inference request, leading to a confidentiality breach. The patch addresses this by changing the 32-bit integers to 64-bit integers (int64_t) to accommodate larger tensor sizes and adds a defense-in-depth measure of filling the allocated tensors with zeros.

Vulnerable functions

ggml_dequantize

csrc/libtorch_stable/quantization/gguf/gguf_kernel.cu

This function allocates an uninitialized tensor `DW` using `torch::stable::empty`. It then calls a dequantization kernel where the size parameter `m * n` (a 64-bit integer) was truncated to a 32-bit integer. If the total number of elements `m * n` exceeded INT_MAX, the kernel would only process a fraction of the tensor, leaving the rest of the buffer uninitialized and exposing stale data from previous GPU operations.

ggml_mul_mat_vec_a8

csrc/libtorch_stable/quantization/gguf/gguf_kernel.cu

This function allocates an uninitialized output tensor `Y` using `torch::stable::empty`. It then uses tensor dimensions, which were read into 32-bit `int` variables like `col`, to perform calculations for subsequent CUDA kernels. If the tensor dimensions were large enough to cause an integer overflow, the truncated value would lead to a partial write into the `Y` tensor, exposing stale data from the uninitialized portion.

ggml_mul_mat_a8

csrc/libtorch_stable/quantization/gguf/gguf_kernel.cu

Similar to `ggml_mul_mat_vec_a8`, this function allocates an uninitialized tensor `Y` with `torch::stable::empty`. The tensor dimension `X.sizes()[1]` was stored in a 32-bit `int`, which could truncate for large tensors. This would cause the processing kernel to only fill part of the tensor `Y`, leading to information disclosure from the remaining uninitialized memory.

ggml_moe_a8

csrc/libtorch_stable/quantization/gguf/gguf_kernel.cu

This function follows the same vulnerable pattern. It allocates an uninitialized tensor `Y` and uses a tensor dimension (`col`) stored as a 32-bit `int`. For large tensors, this value truncates, causing CUDA kernels to perform a partial write, exposing stale data from the parts of the tensor that were not overwritten.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.