CVE-2026-115915

vLLM image decoding can expose vulnerable host parsers

vLLM project · vLLM multimodal image loader

First documented disclosure · Review checkpoint

Summary

Unrestricted image-format detection can send supplied EPS content to vulnerable Ghostscript or Pillow components.

Severity and exploitation evidence

High · 8.1/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed primary sources document a vulnerability or controlled demonstration, not confirmed malicious exploitation.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The declared MIME type does not constrain Pillow’s decoder selection.

Conditions required

A reachable image-capable path; code execution additionally requires Ghostscript vulnerable to CVE-2024-29510. A separate denial-of-service path requires Pillow 12.0.0–12.2.0.

Potential impact

Conditional command execution as the vLLM process, or exhaustion of image-loading workers.

Affected versions and configurations

Before 0.32.0 per the CNA; the researcher tested 0.30.0 rather than every earlier release.

Fix and mitigation status

0.32.0.

Practical next steps

Upgrade vLLM and affected host dependencies; restrict permitted image formats and endpoint access.

Operating lesson

Inventory host executables invoked indirectly by otherwise ordinary model inputs.

Evidence and limits

The public fix discussion on 2026-10-05 predates the October 20 advisory and October 26 CVE publication. Command execution was reproduced at loader level; the HTTP path was source-traced, not tested end to end. Pillow’s separate flaw does not cause code execution.

Sources