CVEsvllm-projectCVE-2026-115915Published Oct 26, 17:16 · Updated Oct 26, 19:35 UTC
8.1
HighCVSS 3.1 · from GitHub_M
CVE-2026-115915

vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE

vllm · Improper input validation · CWE-20
Affectedvllm
FixNo fix listed yet.
PublishedOct 26, 17:16 · GitHub_M
ScoredOct 26 · 8.1 · GitHub_M
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:11 UTC

What we know

No known exploitation. CISA KEV, checked 22:11 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.

Description

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request paths through parse_image() and fetch_image() can therefore dispatch an EPS payload to host components. A host with Ghostscript affected by CVE-2024-29510 can execute commands with the vLLM process's privileges, while environments using Pillow 12.0.0 through 12.2.0 can trigger CVE-2026-59203 and exhaust media-loading workers. Deployments without the applicable vulnerable dependency are not affected by that corresponding impact. This issue is fixed in version 0.32.0.

From GitHub_M

Affected and fixed versions

ProductAffectedFixed invllm< 0.32.0–

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

github.com/vllm-project/vllm/security/advisories/GHSA-h3rc-j82p-2c3h · github.comrefsource_CONFIRMgithub.com/vllm-project/vllm/pull/60022 · github.comrefsource_MISCgithub.com/vllm-project/vllm/commit/710ac56e691d4713feca50a43e6c440f07d373fd · github.comrefsource_MISCgithub.com/vllm-project/vllm/releases/tag/v0.32.0 · github.comrefsource_MISC

Other CVEs in vllm

All 120 →
6.5vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs · CVE-2026-115918Oct 263.4vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server · CVE-2026-115917Oct 266.5vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS) · CVE-2026-115916Oct 26