CVE-2026-90554: vLLM vulnerability

What happened

vLLM versions >=0 10 2 and 28 0 do not apply any audio decode-size or duration limit when extracting audio from video input for NanoNemotronVL models. A security weakness in vLLM is being tracked as CVE-2026-90554. CVE-2026-90554 currently carries a MEDIUM 6 2 severity signal in the retained vulnerability data.

Organizations using vLLM should identify affected versions, map where the vulnerable function is reachable and understand what the affected process can access. Apply the vendor fix or mitigation and review telemetry for exploitation indicators when available. The issue currently carries a MEDIUM 6 2 severity signal in the CyberDeltaForce record.

The important point is that running an affected version of vLLM creates exposure, while an actual compromise still depends on whether the attacker can reach the trigger conditions described above. The operational question is not simply the severity score, but whether the affected component is deployed, reachable, business-critical and protected by compensating controls. The current severity assessment is MEDIUM 6 2.

Real risk depends on exposure, exploitability, compensating controls and the importance of the affected asset—not the CVSS number alone. No exploitation flag is present in the retained CyberDeltaForce data at this time; that status can change as vendor and threat-intelligence reporting develops. Inventory the affected product deployments and confirm whether the affected component and vulnerable release are present.

Apply the vendor patch or mitigation for CVE-2026-90554 and validate the affected path after remediation. The current source set does not report active exploitation of CVE-2026-90554; that status should be monitored rather than treated as proof that exploitation is impossible.

The most useful validation after remediation is to confirm that the vulnerable path no longer permits the reported behavior and that the deployed release matches the vendor's corrected version. So far, researchers have not reported exploitation, but that can change as vendor, government or threat-intelligence reporting develops.