vLLM: Forged shared-memory handles lead to code execution in worker
Summary
vLLM, an inference and serving engine for large language models, is affected in scale-out deployments that use the shared-memory multimodal cache. An authenticated caller can submit forged shared-memory handles through the public API, which causes worker processes to unpickle attacker-chosen bytes. This allows arbitrary Python code execution in the worker, even when insecure serialization is disabled.
Affected
- vLLM versions before 0.32.0
- Relevant only with scale-out mode and the shared-memory multimodal processor cache (--mm-processor-cache-type shm) enabled
- Red Hat AI Inference Server is also listed as affected; fix state unknown
Fixed in
- Fixed in vLLM 0.32.0
Workaround
- No official workaround known.
- Disabling the shared-memory multimodal cache or avoiding scale-out mode is likely to remove the exposed path; this is not vendor-confirmed and must be tested first.
- Restrict who can reach the API and limit which clients hold API keys until patched.
Exploitation
- Not marked as known exploited in the sources checked.
- VulDB reports technical details are known but no public exploit is available.
- A third-party blog includes an unverified exploit-style section; a working exploit may exist.
Our recommendation
- Inventory vLLM versions (pip and containers) and any Red Hat AI Inference Server deployments.
- Upgrade to vLLM 0.32.0 or later.
- Check whether scale-out mode and the shm multimodal cache are enabled; if so, prioritise the upgrade.
- Until patched, review API key issuance, restrict network access and monitor for unexpected worker crashes or processes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-6757-hggm-hp2w github.com
- vLLM release v0.32.0 github.com
- Fix commit 3d5625cc github.com
- Fix pull request #59357 github.com
- OSV GHSA-6757-hggm-hp2w osv.dev
- VulDB entry 426550 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:31.
Original description (NVD)
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonic_id values in public multimodal features.kwargs_data. In scale-out deployments with shared-memory multimodal caching enabled, workers trust those values and pass attacker-selected bytes to pickle.loads(), allowing arbitrary Python execution even when insecure serialization is disabled. This issue is fixed in version 0.32.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.