CVE-2026-22778

The record

vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an error. vLLM returns this error to the client, leaking a heap address. With this leak, we reduce ASLR from 4 billion guesses to ~8 guesses. This vulnerability can be chained a heap overflow with JPEG2000 decoder in OpenCV/FFmpeg to achieve remote code execution. This vulnerability is fixed in 0.14.1.

Affected packages

Related vulnerabilities

• GHSA-4r2x-xpjr-7cvv vLLM has RCE In Video Processing Same vulnerability
• GHSA-qh4c-xf7m-gxfc vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector Also affects vllm
• CVE-2026-24779 vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector Also affects vllm
• GHSA-2pc9-4j83-qjmr vLLM affected by RCE via auto_map dynamic module loading during model initialization Also affects vllm
• CVE-2026-22807 vLLM affected by RCE via auto_map dynamic module loading during model initialization Also affects vllm
• GHSA-grg2-63fw-f2qr vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous… Also affects vllm
• CVE-2026-22773 vLLM is an inference and serving engine for large language models (LLMs). Also affects vllm
• GHSA-mcmc-2m55-j8jj vLLM introduced enhanced protection for CVE-2025-62164 Also affects vllm