Home › CVE Intelligence › CVE-2026-34760
CVSS 5.9 MEDIUM 🔴 ACTIVELY EXPLOITED Security Vulnerability

CVE-2026-34760: vLLM: Processing differential in multi-channel audio downmixing enables hidden-input/mode…

Issue Description Librosa defaults to using numpy.mean for mono downmixing (to_mono), while the international standard ITU-R BS.775-4 specifies a weighted downmixing algorithm. This discrepancy results in: Inconsistency…

5.9CVSS Score
MEDIUMSeverity
NOCISA KEV
0.3%EPSS Score
Security VulnerabilityImpact Type

📋 Vulnerability Details

CVE IDCVE-2026-34760
VendorUnknown Vendor
Affected ProductUnknown Product
Vulnerability TypeSecurity Vulnerability
CVSS Score5.9 (MEDIUM)
EPSS Score0.3% probability of exploitation in the next 30 days
Actively Exploited✅ Yes
Patch StatusPending Vendor Disclosure
Reported ByCYBERDUDEBIVASH SENTINEL APEX Intelligence (via sentinel_apex)

🔬 Technical Analysis

#

Issue Description

• Inconsistency between audio heard by humans (e.g., through headphones/regular speakers) and audio processed by AI models (Which infra via Librosa, such as vllm, transformer).

Librosa defaults to using numpy.mean for mono downmixing (to_mono), while the international standard ITU-R BS.775-4 specifies a weighted downmixing algorithm. This discrepancy results in:

https://github.com/librosa/librosa/blob/af8c839fb15317fa2712ea66e7a22da6a9267b32/librosa/core/audio.py#L478 #

Attack Scenario and Impact

#

LFE (Low-Frequency Effects) Channel Exploit

Attackers can craft special multichannel audio files containing: 1. Normal content in front channels (L/R) 2. Either interference signals or hidden content in the LFE channel

Notice: It is worth noting that not only t

🎯 Known Indicators of Compromise

{"type":"sha1","value":"af8c839fb15317fa2712ea66e7a22da6a9267b32","confidence_score":0.9,"first_seen":"2026-07-17","source_count":1} {"type":"url","value":"https://github.com/librosa/librosa/blob/af8c839fb15317fa2712ea66e7a22da6a9267b32/librosa/core/audio.","confidence_score":0.82,"first_seen":"2026-07-17","source_count":1}
⚡ DETECTION RULES AVAILABLE

Get CVE-2026-34760 Detection Pack

Sigma rules, YARA signatures, IOC table, and SIEM queries for Splunk, Elastic, Sentinel, and Chronicle — deployable in 5 minutes.

✓ Sigma Rules ✓ YARA Pack ✓ IOC Table ✓ SIEM Queries
🛡️ Get Detection Pack → 🔌 Access via API →

🔗 Related Intelligence