Remote Code Execution Vulnerability in vLLM by the vLLM Project
CVE-2026-115914
6.5MEDIUM
What is CVE-2026-115914?
The vulnerability in vLLM, a powerful inference and serving engine for large language models, permits a remote attacker to exploit image input functionalities. Specifically, it allows submission of a legal image that has a normalized pixel sum of zero when processed in an isolated batch. The problematic function, _parse_and_validate_image_input, fails to return a valid embedding, which subsequently affects the embed_multimodal function. This results in a fatal assertion in the sanity_check_mm_encoder_outputs function that can cause a complete shutdown of the engine, affecting all users on the system. This issue has been addressed in version 0.32.0.
Affected Version(s)
vllm >= 0.11.1, < 0.32.0