Image Processing Flaw in vLLM Affecting Open-Source Library
CVE-2026-12491

4.8MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Ai Inference Server
Red Hat Enterprise Linux Ai (rhel Ai) 3
Red Hat Openshift Ai (rhoai)
Vendor
CVE Published:
17 June 2026

What is CVE-2026-12491?

A flaw in the vLLM open-source library arises from improper management of image metadata, particularly concerning EXIF orientation and PNG transparency data during image processing. This issue can lead to the unintended loss or remapping of transparency information when images are converted to RGB, resulting in the incorrect rendering of transparent pixels. Consequently, this misinterpretation of image content can compromise the integrity of the data being processed, making it a critical concern for applications relying on accurate image analysis.

References

https://access.redhat.com/security/cve/CVE-2026-12491
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2489786
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.