CVE-2026-34760: vLLM Audio Pipeline Patch Is a Partial Fix

Vulnerability

CVE-2026-34760 and the vendor advisory GHSA-6C4R-FMH3-7RH8 describe an adversarial prompt-injection issue in vLLM prior to 0.18.0 where multi-channel audio is downmixed using an unweighted mathematical mean. That behavior can let an attacker place hidden or physically inaudible content in one or more channels such that the model receives a semantically different mono signal than a human listener would perceive.

The vulnerable behavior is directly visible in the supplied patch context for vllm/multimodal/media/audio.py, where decoded channel data is concatenated and then reduced with a plain mean:

audio = np.concatenate(chunks, axis=-1)
if audio.ndim > 1:
    audio = audio.mean(axis=0)
return audio.astype(np.float32), float(native_sr)

This is the core security concern: channel reduction is treated as a generic signal-processing step rather than a security-sensitive transformation. For adversarial audio, averaging channels can surface hidden instructions or alter relative energy in ways that are not aligned with human audibility. The issue is corroborated by the advisory and CVE records: GHSA, NVD, and CVE.

Patch

The patch substantially refactors the audio stack away from librosa and toward PyAV/FFmpeg-backed decoding and resampling. The main changes shown in the supplied sources are:

• Default resampling method changes from librosa to pyav in vllm/multimodal/audio.py and vllm/multimodal/parse.py, with the method literal updated from "librosa" to "pyav". See PR #37058.
• Audio loading paths in assets, video handling, and speech-to-text are consolidated around a shared loader instead of mixed librosa and fallback logic. See the commit c7f98b4d0a63b32ed939e2b6dfaa8a626e9b46c4.
• The patched resampler implementation is narrowed to mono input/output in one shown revision, which removes the earlier explicit support for arbitrary multi-channel arrays during resampling.
• Tests are updated to exercise PyAV-based behavior and remove librosa-specific assumptions.

A representative patched snippet shows the new mono-only resampling path:

resampler = av.AudioResampler(format="fltp", layout="mono", rate=target_sr_int)
frame = av.AudioFrame.from_ndarray(audio_f32, format="fltp", layout="mono")
out_frames = resampler.resample(frame)
result = np.concatenate([f.to_ndarray() for f in out_frames])
return result

Another patched loader path shows PyAV being used to decode and resample directly to mono:

resampler = av.AudioResampler(
    format="fltp", layout="mono", rate=sr or native_sr
)
for frame in container.decode(stream):
    for out_frame in resampler.resample(frame):
        chunks.append(out_frame.to_ndarray())

These changes are source-grounded in the pull request and the referenced commit.

Review

Pros

• The patch reduces pipeline inconsistency by removing the mixed librosa/soundfile/PyAV fallback behavior and standardizing on PyAV-backed decoding. That is operationally cleaner and easier to reason about.
• Changing defaults from librosa to pyav and moving to mono-oriented processing reduces the number of places where arbitrary multi-channel arrays are propagated through the stack.
• The speech-to-text entrypoint now uses a single loader and converts decode failures into a uniform validation error, which simplifies error handling and avoids backend-specific edge cases.
• Tests were updated to reflect the new backend and to validate end-to-end mono passthrough assumptions, which helps prevent regressions in the new code path.

Cons

• The supplied diffs do not show a security-aware downmix algorithm. In one patched loader variant, channel reduction is still implemented as audio.mean(axis=0), which is the exact class of unsafe unweighted averaging called out by the CVE.
• The patch appears to change implementation details and defaults more than it introduces a principled mitigation. There is no visible psychoacoustic weighting, no per-channel validation, no rejection of suspicious channel layouts, and no detection of low-audibility/high-ASR-salience content.
• The mono-only resampler reduces exposure only if all upstream decode paths reliably produce trusted mono output. The provided snippets do not prove that every path avoids unsafe averaging before resampling.
• The test changes focus on backend migration and shape/length behavior, not on adversarial multi-channel security properties. No supplied test demonstrates that hidden-channel prompt injection is blocked.
• Because the patch removes one backend and centralizes decoding, it may improve determinism, but determinism alone is not a fix for adversarial signal construction.

Verdict

Partial fix.

The patch clearly hardens the audio pipeline by standardizing on PyAV and biasing processing toward mono, but the supplied sources do not show a complete remediation of the root issue described in GHSA-6C4R-FMH3-7RH8. Most importantly, one patched implementation still performs channel reduction with a plain arithmetic mean, and none of the shown changes establish a security-preserving downmix policy. For a root-cause fix, the code should either avoid implicit downmixing of untrusted multi-channel inputs, apply a documented and security-reviewed channel selection/weighting strategy, or reject channel configurations that cannot be safely normalized for ASR/LLM ingestion. As shown in the provided diffs, the patch reduces risk but does not conclusively eliminate the vulnerability class.