Image Processing Vulnerability in vLLM by vLLM Project

CVE-2026-115915

What is CVE-2026-115915?

The vLLM inference engine for large language models has a vulnerability where attacker-controlled image data is passed to Pillow without proper decoder restrictions. This oversight allows crafted EPS files to execute commands with the privileges of the vLLM process on systems running Ghostscript. Notably, certain versions of Pillow can also lead to resource exhaustion in media-loading workers. The issue has been addressed in vLLM version 0.32.0, emphasizing the importance of upgrading to secure versions to mitigate potential risks.

References