CVE-2026-115915: vLLM image loading flaw allows EPS payload dispatch

Summary

vLLM versions before 0.32.0 pass attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, so the MIME label does not constrain the format. Image-capable request paths via parse_image() and fetch_image() can dispatch an EPS payload to host components. A host with Ghostscript affected by CVE-2024-29510 can run commands with the vLLM process's privileges, while Pillow 12.0.0 through 12.2.0 can trigger CVE-2026-59203 and exhaust media-loading workers.

Mitigation

Fixed in 0.32.0.

Topics

• Inference infrastructure

Related items

• HighCVE-2026-115924: Rembg unauthenticated file disclosure through public /api/remove endpointSimilar attack · NVD/CVE Database
• LowThe RealReal won’t let AI agents hog designer clothingSimilar attack · The Verge (AI)
• HighCVE-2026-115912: vLLM arbitrary Python execution via forged shared-memory multimodal dataSimilar attack · NVD/CVE Database
• InfoThe Agent in the Middle: How AI-Mediated Access Reshapes Web Vulnerability ExploitationSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumOpenAI, Anthropic disclosures spotlight growing AI containment challengeSimilar attack · CSO Online