{"data":{"id":"5693ae9b-7288-4555-8376-d84c382b58b5","title":"CVE-2026-115915: vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes…","summary":"vLLM versions before 0.32.0 pass attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, so the MIME label does not constrain the format. Image-capable request paths via parse_image() and fetch_image() can dispatch an EPS payload to host components. A host with Ghostscript affected by CVE-2024-29510 can run commands with the vLLM process's privileges, while Pillow 12.0.0 through 12.2.0 can trigger CVE-2026-59203 and exhaust media-loading workers.","solution":"Fixed in 0.32.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115915","publishedAt":"2026-10-26T18:17:38.883Z","cveId":"CVE-2026-115915","cweIds":["CWE-20","CWE-183"],"cvssScore":"8.1","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["vLLM","Pillow","Ghostscript"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"vLLM image loading flaw allows EPS payload dispatch","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"network","attackComplexity":"high","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-27T06:10:23.076Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-27T06:10:30.046Z","patchAvailable":null,"disclosureDate":"2026-10-26T18:17:38.883Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}