IT SBIT Services
Schneeberger
DEEN
CVE tracker

vLLM: Improper image format validation allows code execution and denial of service

CVE-2026-115915Critical 9.8

← All vulnerabilities

Summary

vLLM before 0.32.0 passes untrusted image bytes to Pillow's format autodetection without restricting the accepted formats, so an EPS (PostScript) payload can reach Ghostscript. If the host has a Ghostscript build affected by CVE-2024-29510, a caller who can reach an image-capable request path can execute commands with the privileges of the vLLM process. Environments with Pillow 12.0.0 to 12.2.0 are also exposed to CVE-2026-59203, which can exhaust the media-loading workers without code execution.

Affected

  • vLLM versions before 0.32.0 (the vendor confirms 0.30.0; the exact lower bound is not stated)
  • Hosts with Ghostscript affected by CVE-2024-29510 (execution chain only)
  • Environments with Pillow 12.0.0 to 12.2.0 (denial of service only)

Fixed in

  • vLLM 0.32.0 (restricts untrusted images to a raster format allowlist that excludes EPS and WMF)
  • Pillow 12.3.0 or later is recommended (secondary source; not confirmed by the vendor)

Workaround

Unknown. No vendor-documented workaround exists. Interim measures that are not verified by the vendor:

  • Restrict network access to the vLLM API and limit which clients can send image requests
  • Check whether Ghostscript is installed on the host and remove it if it is not needed
  • Pin Pillow to a patched version

Exploitation

  • CISA SSVC: exploitation none, not automatable
  • No evidence of exploitation in the wild found
  • The vendor reproduced command execution at loader level with Debian Ghostscript 10.03.0; the full HTTP path was not exercised end to end

Our recommendation

  • Inventory all vLLM instances, including container images and lockfiles, and record their versions
  • Upgrade vLLM to 0.32.0 and pin Pillow to 12.3.0 or later
  • Check whether Ghostscript is installed on the hosts and remove it if it is not required
  • Restrict who can reach the API until patching is complete
  • Monitor logs for unusual image requests and for worker timeouts

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:32.

Original description (NVD)

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request paths through parse_image() and fetch_image() can therefore dispatch an EPS payload to host components. A host with Ghostscript affected by CVE-2024-29510 can execute commands with the vLLM process's privileges, while environments using Pillow 12.0.0 through 12.2.0 can trigger CVE-2026-59203 and exhaust media-loading workers. Deployments without the applicable vulnerable dependency are not affected by that corresponding impact. This issue is fixed in version 0.32.0.

NVD references (4)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed