vLLM, an inference and serving engine for large language models, contains an integer overflow vulnerability (CWE-190) in versions before 0.27.0. Specifically, an overflow in the calculation blockIdx.x * 2 * d in activation_kernels.cu leads to the act_and_mul_kernel function consuming input data from another user in the same inference batch. This can result in cross-user data leakage where one user's inference request may receive partial or complete results intended for another user. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity, with network attack vector, high attack complexity, no privileges required, and user interaction needed. The issue is fixed in vllm version 0.27.0.

The vulnerability allows information disclosure between users sharing the same inference batch, potentially exposing sensitive inference results to unauthorized users. There is no indication of integrity or availability impact. No known exploits are reported in the wild.

Upgrade to vllm version 0.27.0 or later, where this integer overflow vulnerability is fixed. No other mitigation or temporary workaround is documented. Patch status is confirmed by the vendor advisory stating the fix is included in version 0.27.0.