CVE-2026-115915 in vLLM
Summary
by MITRE • 10/26/2026
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request paths through parse_image() and fetch_image() can therefore dispatch an EPS payload to host components. A host with Ghostscript affected by CVE-2024-29510 can execute commands with the vLLM process's privileges, while environments using Pillow 12.0.0 through 12.2.0 can trigger CVE-2026-59203 and exhaust media-loading workers. Deployments without the applicable vulnerable dependency are not affected by that corresponding impact. This issue is fixed in version 0.32.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified in vLLM prior to version 0.32.0 stems from a critical flaw in how image media input is processed within the inference and serving engine for large language models. Specifically, the ImageMediaIO component utilizes Pillow’s Image.open method with BytesIO objects containing attacker-controlled data without enforcing strict constraints on decoder selection or MIME type validation. This architectural oversight allows an adversary to manipulate the format interpretation of uploaded images by bypassing standard security checks that would normally restrict processing to safe, expected formats. The parse_image and fetch_image functions serve as entry points for this malicious activity, effectively creating a pathway through which untrusted image payloads can be dispatched directly to host system components responsible for rendering or analyzing visual data.
The operational impact of this flaw is severe due to its potential to facilitate Remote Code Execution on the hosting infrastructure. When an attacker submits a specially crafted Encapsulated PostScript file disguised as an image, the vLLM process may invoke Ghostscript to render it. If the host system runs a version of Ghostscript vulnerable to CVE-2024-29510, this interaction can result in arbitrary command execution with the same privileges as the vLLM service account. This represents a classic case of insecure deserialization or unsafe file handling where external control over input format leads to unintended side effects within dependent libraries. Furthermore, even if Ghostscript is not present or patched, environments utilizing Pillow versions between 12.0.0 and 12.2.0 remain susceptible to CVE-2026-59203. In such scenarios, the vulnerability can be leveraged to trigger resource exhaustion attacks by consuming media-loading workers indefinitely, thereby causing a Denial of Service condition that disrupts service availability for legitimate users.
From a classification perspective, this issue aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command and CWE-20 Improper Input Validation. The lack of MIME label constraint directly correlates to weaknesses identified under these categories, as the system fails to validate that the input matches its declared type before processing. In terms of adversary tactics, this vulnerability maps to MITRE ATT&CK techniques involving Initial Access via Exploitation of Remote Services and Execution through Command and Scripting Interpreter if Ghostscript is exploited. The ability to exhaust worker resources also relates to Availability impact categories within the framework, highlighting the dual nature of the threat as both a confidentiality/integrity risk and an availability risk depending on the deployed software stack.
Mitigation strategies must prioritize immediate upgrading to vLLM version 0.32.0 or later, where these input validation mechanisms have been corrected. For organizations unable to upgrade immediately, implementing strict allowlists for supported image formats at the network perimeter or within a reverse proxy can prevent malicious payloads from reaching the application layer. Additionally, ensuring that underlying dependencies such as Ghostscript and Pillow are updated to their latest secure versions provides defense in depth against known exploits associated with these libraries. Isolating vLLM processes using containerization or sandboxing techniques further limits the blast radius should an exploit succeed, reducing the potential for privilege escalation on the host system. Regular auditing of third-party library dependencies is essential to maintain a robust security posture against evolving threats targeting media processing components.