Arbitrary Python Code Execution Vulnerability in vLLM by vLLM Project
CVE-2026-115912
7.5HIGH
What is CVE-2026-115912?
vLLM, an inference and serving engine for large language models, contains a vulnerability where authenticated users can manipulate shared-memory addresses and monotonic_id values within the multimodal features. This flaw, present in versions before 0.32.0, allows for the execution of arbitrary Python code via the untrusted handling of serialized data during distributed operations with shared-memory caching. The issue has been addressed in version 0.32.0, enhancing the security of the system against external exploitation.
Affected Version(s)
vllm < 0.32.0