vLLM CVE-2026-115915

Exploitation requires ALL of: (1) a multimodal, image-capable request path enabled in vLLM - the OpenAI chat parser routes through parse_image()/fetch_image() and the media connector's data-URL handler, which forwards attacker bytes to ImageMediaIO without a Pillow format allowlist (pre-0.32.0); (2) a caller able to reach that endpoint under the deployment's authentication/network policy (API key and network controls determine who qualifies); and (3) for RCE, a host-provided Ghostscript build affected by CVE-2024-29510 - vLLM declares Pillow but NOT Ghostscript, so this executable must come from the host or container image - OR, for the alternative DoS impact, an installed Pillow in the 12.0.0-12.2.0 range (vllm 0.30.0 leaves Pillow unpinned, so existing environments can retain an affected version). LIMITING FACTORS: deployments with no Ghostscript or a build fixed at/after 10.03.1 are not exposed to the code-execution chain; environments on Pillow ≥12.3.0 are not exposed to the worker-exhaustion DoS; and endpoints gated by strong authentication or network isolation reduce who can reach the vulnerable boundary. The payload-trigger mechanism (EPS signature autodetection) is described, but the end-to-end HTTP trigger was not exercised in the sources.

The input CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1 High) describes a network-reachable flaw that, when it succeeds, yields full confidentiality, integrity and availability loss consistent with command execution. However, the AC:H rating is the key honest signal: this is an N-day dependency chain, not a self-contained vLLM RCE. The vLLM-specific defect is unsafe dispatch of untrusted image bytes to Pillow's format autodetection; code execution only occurs when the host separately runs a Ghostscript build vulnerable to CVE-2024-29510 (which vLLM does not declare or ship), and the denial-of-service only occurs when Pillow 12.0.0-12.2.0 (CVE-2026-59203) is installed. Deployments lacking those vulnerable dependencies are not affected by the corresponding impact, which materially narrows real-world exposure below what a raw 8.1 implies. No EPSS score was provided, so exploitation probability cannot be quantified. This CVE is NOT in CISA KEV and there is no confirmed active exploitation. The vuln.today decision label is 'this_week' (not act_now/emergency), aligning with a serious-but-conditional priority rather than a drop-everything emergency. The researcher reproduced loader-level command execution (via ImageMediaIO.load_base64 with Debian Ghostscript 10.03.0) but did not exercise the HTTP request path end to end - so the network-vector claim is source-traced, not demonstrated. On PR:N: the CVSS marks it unauthenticated, but the advisory states that API-key and network controls govern who can reach the endpoint, so effective reachability depends on deployment auth policy - verify against your own configuration.

An attacker who can reach a multimodal (image-capable) vLLM endpoint submits a chat/completions request containing an EPS/PostScript payload inside a data URL labeled image/png; because the MIME label does not constrain decoder selection, Pillow autodetects the EPS signature and invokes the host's Ghostscript on the attacker's PostScript. If that Ghostscript is affected by CVE-2024-29510, the crafted payload bypasses -dSAFER and executes commands as the vLLM process user; if Pillow 12.0.0-12.2.0 is present instead, a negative %%BeginBinary byte count hangs media-loading workers for denial of service. A loader-level PoC reference exists (command execution reproduced against Debian Ghostscript 10.03.0), but it is not verified as a working end-to-end HTTP exploit - the request path was source-traced only.