Live › vulnerability › CVE-2026-115915
Go to dashboardvLLM passes attacker-supplied image bytes to Pillow without restricting which decoder runs, so an EPS payload can be dispatched through image request paths. On a host with a vulnerable Ghostscript, the payload can run commands with the vLLM process's privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 18:31 UTC. All times on this page are UTC.
Deployments running vLLM before 0.32.0 that accept image inputs through request paths such as parse_image() or fetch_image() are exposed. The command-execution impact requires a host with Ghostscript affected by CVE-2024-29510; the worker exhaustion impact requires Pillow 12.0.0 through 12.2.0. Deployments without the vulnerable dependency are not affected by that corresponding impact.
No product ranges from the sources yet.
pip show vllm and compare against 0.32.0.gs --version and whether it is affected by CVE-2024-29510.pip show pillow; versions 12.0.0 through 12.2.0 are also named in the sources.0.32.0 or later.12.2.0 if you run a version in that range (fixed version unknown from sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request paths through parse_image() and fetch_image() can therefore dispatch an EPS payload to host components. A host with Ghostscript affected by CVE-2024-29510 can execute commands with the vLLM process's privileges, while environments using Pillow 12.0.0 through 12.2.0 can trigger CVE-2026-59203 and exhaust media-loading workers. Deployments without the applicable vulnerable dependency are not affected by that corresponding impact. This issue is fixed in version 0.32.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-115915")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.