vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE (CVE-2026-115915)
Published Last modified Sources: OSV, Hersteller, CVE.org
What is affected, what to do
Update vLLM to version 0.32.0.
- Affected
- vLLM
lt *..0.32.0
- vLLM
- Fixed in
- vLLM
0.32.0
- vLLM
Not sure whether and how you are affected? Ask a question about this vulnerability
Metrics
9.8
Priority
XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.
Source: NVD, CVSS v3
9.8
CVSS v3
Severity Critical on the scale from 0 to 10.
Source: OSV, Hersteller, CVE.org
0.7 %
EPSS score
Low — model estimates < 1% exploitation likelihood.
Source: FIRST EPSS, percentile 51.5
Show all metrics
- Severity
- Critical
Priority (0–325)
The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?
Read in glossary- 100.19 Methodology
Exploit maturity
An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.
Read in glossary- no public PoC known
XIEM Effective CVSS
XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.
Read in glossary- 9.8 Methodology
CVSS v3
CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.
Read in glossary- 9.8
EPSS score
The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.
Read in glossary- 0.7 %
- Low — model estimates < 1% exploitation likelihood.
EPSS percentile
The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.
Read in glossary- 51.5
- High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
KEV status
The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.
Read in glossary- —
- Published
- CISA assessment (SSVC)
- Exploitation: none known · not automatable · Technical impact: total
- Source: CISA Vulnrichment, as of 26 October 2026
CWE
CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect.
Read in glossary- CWE-183, CWE-20
Detection rules
No NEOSEC detection rule is available for this vulnerability yet.
Classification under NIS2 and CRA
Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.
NIS2
NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.
Read in glossary- High technical severity: assess and remediate the vulnerability in vulnerability handling under Art. 21(2)(e) NIS2 and document the decision.
CRA
The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.
Read in glossary- From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.
ISO/IEC 27001
ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.
Read in glossary- Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.
Description
Summary
In vLLM 0.30.0, ImageMediaIO passes attacker-controlled image bytes to Pillow's format autodetection without restricting the accepted formats; the request's MIME label does not constrain decoder selection. An EPS payload labeled image/png reached the host's Ghostscript executable. On a host with Ghostscript affected by CVE-2024-29510, this exposes the known Ghostscript sandbox escape through vLLM's image-loading path and can execute commands with the vLLM process's privileges. A bounded marker-command payload executed through the PyPI wheel's actual ImageMediaIO.load_base64() implementation using Debian Ghostscript 10.03.0. The loader-level execution is reproduced; the HTTP request path is source-traced but was not exercised end to end. This report concerns vLLM's untrusted-format dispatch and does not claim a new Ghostscript vulnerability. Exploitation requires an image-capable request path, a caller able to reach it under the deployment's authentication policy, and a vulnerable host Ghostscript build.
Details
ImageMediaIO is the boundary where attacker-controlled bytes enter Pillow's format autodetection: the declared MIME type does not constrain decoder selection, and the loader calls Image.open(BytesIO(data)) without a Pillow format allowlist. Pillow recognizes EPS by its file signature, and vLLM's subsequent image.load() call enters Pillow's EPS processing path. The OpenAI chat multimodal parser reaches this path through parse_image() and fetch_image() and the media connector; the data URL path extracts the MIME label and forwards the bytes to the loader (source). This is the vLLM-specific issue: untrusted image bytes can select a Pillow-supported format parser. Each downstream impact depends on the relevant parser, component version, and host configuration.
Pillow recognizes EPS by its file signature and invokes Ghostscript with -dSAFER, -sDEVICE=pnmraw, and the untrusted EPS input (Pillow EPS plugin, load path). The command execution in this report uses the already-known Ghostscript CVE-2024-29510, which allows crafted PostScript to bypass -dSAFER; Ghostscript lists 10.03.1 as the upstream fixed version (Ghostscript CVE details). This is an N-day dependency chain: CVE-2024-29510 provides the command-execution primitive, while the vLLM-specific issue is that untrusted, remotely supplied image bytes can reach the affected interpreter. No new Ghostscript flaw is claimed here.
The vLLM Python requirements declare Pillow but not Ghostscript, so this execution chain depends on a Ghostscript executable supplied by the host or deployment image. I reproduced command execution with the PyPI vllm==0.30.0 wheel, Pillow 12.3.0, and Debian amd64 Ghostscript 10.03.0~dfsg-1. The Codean Labs CVE-2024-29510 testkit identified that Ghostscript build as vulnerable. The adapted EPS payload ran only touch on a temporary marker. The marker existed after the loader call, although Pillow then raised ValueError because the exploit changes Ghostscript's output device. The API route was traced in source but a model-backed HTTP request was not run. Only PyPI vllm==0.30.0 was checked; no wider affected release range or other Ghostscript vendor build is claimed.
The same input boundary also exposes a separate Pillow-only denial-of-service condition when the installed Pillow version is 12.0.0–12.2.0. CVE-2026-59203 is triggered by a negative %%BeginBinary byte count and causes Pillow's EPS parser to loop during Image.open(); it does not invoke Ghostscript or provide code execution (Pillow advisory). The published vllm==0.30.0 requirements leave Pillow unpinned, so an existing environment can retain an affected Pillow version; the source at commit bc21cba9673cfc2256a2726b4bc32f062237cd35 requires pillow>=12.3.0. In an isolated local check with Pillow 12.2.0, the official sample hung through ImageMediaIO.load_bytes() and MediaConnector.fetch_image_async(). Eight concurrent image loads occupied the connector's eight media-loading threads and left a benign image load queued. Pillow 12.3.0 rejected the sample promptly. This confirms a conditional media-processing DoS path, separate from the Ghostscript RCE chain; full HTTP-server availability was not measured.
Impact
When a vLLM image-processing endpoint accepts attacker-supplied content and the host has Ghostscript affected by CVE-2024-29510, a caller who can reach the endpoint can trigger command execution as the vLLM process user. API-key authentication and network access controls determine who can reach the request path. Deployments without Ghostscript or with a build fixed for CVE-2024-29510 are not affected by this execution chain. Separately, existing environments that run vLLM 0.30.0 with Pillow 12.0.0–12.2.0 are exposed to CVE-2026-59203 through the same image-format dispatch boundary; the demonstrated impact is exhaustion of media-loading workers, and this Pillow CVE does not cause RCE. The report asks vLLM to assess and address the unsafe dispatch of untrusted image bytes and the affected dependency combinations.
This advisory was fixed in MR60022.
Source: OSV (Open Source Vulnerabilities), GitHub Security Advisories, NVD (NIST), cvelistv5
Affected products
The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.
| Affected versions | Fixed in | ||
|---|---|---|---|
| vllm-project | vllm |
|
|
| vllm | vllm |
|
|
| pip | vllm |
|
|
| pypi | vllm |
|
|
Vendors and products
Weakness classes (CWE)
CWE-183Permissive List of Allowed Inputs
Base
The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.
Entry at MITRE CWE-183CWE-20Improper Input Validation
Class
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Entry at MITRE CWE-20
References & sources
- github.comvllm-project/vllm/commit/710ac56e691d4713feca50a43e6c440f07d373…x_refsource_MISC, Patch, web, fix
- github.comvllm-project/vllm/pull/60022x_refsource_MISC, Patch, web, fix
- github.comvllm-project/vllm/releases/tag/v0.32.0x_refsource_MISC, Release notes, web, advisory
- github.comvllm-project/vllm/security/advisories/GHSA-h3rc-j82p-2c3hx_refsource_CONFIRM, Patch, Vendor advisory, web, fix
- NVD (NIST)vuln/detail/CVE-2026-115915advisory
- github.comvllm-project/vllmpackage
Changes to this CVE
Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).
Initial analysis by NVDNVD
Newly listed as affected:- vLLM (0.30.0 – before 0.32.0)
CVSS V3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show 6 original changes
Individual changes of this event as published by NVD Type Action Before After CVSS added —AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HProduct configuration added —OR *cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:* versions from (including) 0.30.0 up to (excluding) 0.32.0Reference type added —GitHub, Inc.: https://github.com/vllm-project/vllm/commit/710ac56e691d4713feca50a43e6c440f07d373fd Types: PatchReference type added —GitHub, Inc.: https://github.com/vllm-project/vllm/pull/60022 Types: PatchReference type added —GitHub, Inc.: https://github.com/vllm-project/vllm/releases/tag/v0.32.0 Types: Release NotesReference type added —GitHub, Inc.: https://github.com/vllm-project/vllm/security/advisories/GHSA-h3rc-j82p-2c3h Types: Patch, Vendor AdvisorySource identifier: nvd@nist.gov
Record modifiedCISA ADP
CISA assessment (SSVC): exploitation: none known, automatable: no
Show the original change
Individual changes of this event as published by NVD Type Action Before After SSVC assessment added —{"id":"CVE-2026-115915","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-26T19:31:21.498549Z"}Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0
ReceivedGitHub
CVSS V3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness type: CWE-20, CWE-183
Description added or changed
Show 9 original changes
Individual changes of this event as published by NVD Type Action Before After Description added —vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request paths through parse_image() and fetch_image() can therefore dispatch an EPS payload to host components. A host with Ghostscript affected by CVE-2024-29510 can execute commands with the vLLM process's privileges, while environments using Pillow 12.0.0 through 12.2.0 can trigger CVE-2026-59203 and exhaust media-loading workers. Deployments without the applicable vulnerable dependency are not affected by that corresponding impact. This issue is fixed in version 0.32.0.CVSS added —AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HWeakness type (CWE) added —CWE-20Weakness type (CWE) added —CWE-183Affected versions (publisher) added —New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/115xxx/CVE-2026-115915.json">CVE-2026-115915</a>Reference added —https://github.com/vllm-project/vllm/commit/710ac56e691d4713feca50a43e6c440f07d373fdReference added —https://github.com/vllm-project/vllm/pull/60022Reference added —https://github.com/vllm-project/vllm/releases/tag/v0.32.0Reference added —https://github.com/vllm-project/vllm/security/advisories/GHSA-h3rc-j82p-2c3hSource identifier: security-advisories@github.com
Embed badge
Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.
<a href="https://intel.neosec.eu/en/cve/CVE-2026-115915"><img src="https://intel.neosec.eu/badge/cve/CVE-2026-115915.svg?lang=en" alt="CVE-2026-115915 – NEOSEC Intel" height="20"></a>