CVE-2025-62164 is a critical vulnerability in Red Hat AI Inference Server 3.3.5 (Spyre) involving unsafe deserialization of malicious serialized sparse tensors via torch.load() without validation. Due to PyTorch 2.8.0 disabling sparse-tensor integrity checks by default, crafted tensors can bypass bounds checks and cause out-of-bounds memory writes during to_dense() conversion. This memory corruption can lead to denial of service and potentially remote code execution on the vLLM server. The affected code path is part of the standard Completions API workflow, which is network-reachable and unauthenticated, exposing a broad attack surface. Red Hat has classified this vulnerability as important (critical severity) due to the combination of remote exploitability, memory corruption, and potential for full service compromise. No patch or mitigation meeting Red Hat's standards is currently available.

The vulnerability allows attackers to remotely supply crafted serialized tensors that cause out-of-bounds memory writes, leading to server crashes (denial of service) and potentially remote code execution. This can result in full compromise of the Red Hat AI Inference Server vLLM service. The attack surface is broad because the vulnerable code is part of the unauthenticated Completions API, which is network-exposed. No known exploits are reported in the wild at this time.

No official fix or mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates. Until a fix is released, consider restricting network access to the vulnerable API if possible and apply any recommended security best practices from Red Hat support channels. Customers with Red Hat Technical Account Managers (TAM) can consult directly for guidance.