Cloudanix VulnDB

CVE-2026-115915

High · 8.1

CVSS

8.1

EPSS

0.7%

Published

Oct 26, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in how the system handles uploaded images could let someone run commands or slow down the AI service if certain supporting programs are also present.

Chainable
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Remote Code Execution
Component
Application
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw allows attacker-controlled image bytes to reach Pillow via Image.open(BytesIO(data)) without format restrictions from MIME labels, dispatching EPS payloads through parse_image() and fetch_image() paths to trigger Ghostscript command execution or Pillow resource exhaustion in affected dependency versions.

Why it matters to the business

Remote code execution or worker exhaustion on inference servers can interrupt LLM serving workloads, though low EPSS and absence from KEV indicate limited observed exploitation five days after publication.

How an attack unfolds

An attacker crafts an EPS image payload and submits it through image-capable request paths; vLLM passes the bytes unrestricted to Pillow, which invokes a vulnerable Ghostscript instance (CVE-2024-29510) under the vLLM process privileges or hits the Pillow exhaustion issue (CVE-2026-59203).

How to fix it

Upgrade vLLM to version 0.32.0 or later; ensure underlying Ghostscript and Pillow versions are not the vulnerable ranges noted in the advisory; deployments without the affected dependencies require no action.

How to confirm the fix worked

Confirm vLLM version is 0.32.0 or newer; test image ingestion paths with benign payloads to verify decoder restrictions are active; review dependency manifests for Ghostscript and Pillow versions.

Typical attack path

  1. Identify an image-accepting endpoint in vLLM
  2. Craft and send EPS payload disguised as a valid image request
  3. Trigger dispatch to Pillow and downstream Ghostscript
  4. Achieve command execution or resource exhaustion

How to detect it

Review application logs for unexpected EPS file handling or Pillow decoder selections; inspect process creation events around image request timestamps; correlate with worker exhaustion or high CPU patterns on media-loading threads.

What your security team should do

  • Prioritize upgrade to vLLM 0.32.0 within standard change windows given low EPSS
  • Audit and patch Ghostscript and Pillow instances in the same environment
  • Restrict image input sources until patched
  • Monitor for unusual process spawns or worker restarts post-upgrade

The record

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request paths through parse_image() and fetch_image() can therefore dispatch an EPS payload to host components. A host with Ghostscript affected by CVE-2024-29510 can execute commands with the vLLM process's privileges, while environments using Pillow 12.0.0 through 12.2.0 can trigger CVE-2026-59203 and exhaust media-loading workers. Deployments without the applicable vulnerable dependency are not affected by that corresponding impact. This issue is fixed in version 0.32.0.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities