vLLM CVE-2026-116177

Exploitation requires the vLLM instance to have imported a Nemotron-VL processor - i.e., it is serving a Nemotron-VL model or otherwise loads vllm/transformers_utils/processors/nemotron_vl.py or nano_nemotron_vl.py; the dangerous Image.MAX_IMAGE_PIXELS = None side effect only takes hold once that module is loaded. Given that, no authentication or user interaction is needed (CVSS PR:N/UI:N): any party able to reach the /v1/chat/completions endpoint can submit an attacker-controlled image. Limiting factors: deployments not loading a Nemotron-VL processor are not affected via this path; network reachability of the inference endpoint is required; and impact is confined to availability (worker OOM / DoS to co-tenants), with no confidentiality or integrity effect.

Signals align reasonably well. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes an unauthenticated, low-complexity, remote attack with no attack-requirement caveats, and the impact is scoped purely to availability (VA:H, with VC/VI = N) - consistent with CWE-400 uncontrolled resource consumption and the described OOM-kill denial of service. This is a genuine availability issue, not a confidential/integrity breach, so the 8.7 score reflects a high-impact DoS rather than a system-compromise flaw. No CISA KEV listing and no EPSS score are present in the input, so exploitation-probability data is MISSING; absence of EPSS/KEV does not mean low risk here, but it means widespread active exploitation is not confirmed. There is no verified public exploit code - only vendor/VulnCheck advisories. The vuln.today decision label is 'this_week' (prioritize, but not act_now/emergency). The key limiting factor NOT captured by the network/unauth CVSS metrics is that exploitation requires the target to be serving a Nemotron-VL model or to otherwise have imported the Nemotron-VL processor module, which narrows the real exploitable population considerably - verify whether your deployment loads these processors before treating this as broadly exploitable.

An unauthenticated attacker reaches the public /v1/chat/completions endpoint of a vLLM instance that has loaded a Nemotron-VL processor and submits a pathological decompression-bomb image (a small file that expands to enormous pixel dimensions). Because the processor has globally set Image.MAX_IMAGE_PIXELS = None, Pillow's bomb guard is disabled, so decoding the image exhausts memory and OOM-kills the worker, denying service to co-tenants on the same process. No verified public exploit code is identified; only vendor/VulnCheck advisories exist, though the technique (image decompression bomb) is well understood and low-complexity.