This vulnerability is a concurrency issue (CWE-362) in vllm versions >=0.20.2rc0 <0.26.0 where the process-global sparse tensor invariant guard used in torch.sparse.check_sparse_tensor_invariants() is improperly synchronized. The guard uses save/enable/restore operations on a global flag in PyTorch 2.11.0. When two prompt-embedding parts are processed concurrently in one /v1/chat/completions request, one context may restore the global flag to false while the other is still inside its guarded section. This allows the second context to load an invalid sparse tensor without the invariant check, leading to unsafe tensor.to_dense() calls. The vulnerability builds on the previously reported CVE-2025-62164 but introduces a distinct concurrency root cause. Exploitation requires the --enable-prompt-embeds flag but not other optional features. The vulnerability was introduced after partial fixes for CVE-2025-62164 and is confirmed by deterministic testing with hash-verified source. The affected code is in vllm/renderers/embed_utils.py around the guarded loader. The vulnerability does not require API authentication and can be triggered in the default server configuration if --enable-prompt-embeds is enabled.

An attacker can bypass the sparse tensor invariant guard due to a race condition, causing deserialization of malformed sparse tensors. This can lead to memory corruption, denial of service, or potentially code execution as previously documented for CVE-2025-62164. The concurrency flaw allows a malicious payload to be processed unsafely within a single chat completion request, increasing the risk of exploitation. However, the --enable-prompt-embeds feature is default off, reducing exposure unless explicitly enabled. API authentication is optional, so unauthenticated requests may trigger the vulnerability if the feature is enabled.

No official patch or fix is explicitly stated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid enabling the --enable-prompt-embeds feature in production environments. If this feature is required, consider applying additional synchronization controls or isolating usage to trusted inputs. Monitor vendor communications for updates and patches addressing this concurrency issue.