EUVD-2026-37645Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Network vector reflects API exposure; AC:H reflects required precision in metadata crafting; PR:N aligns with typical unauthenticated inference endpoints; C:N because no data disclosure occurs.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Lifecycle Timeline
2Blast Radius
ecosystem impact- 8 pypi packages depend on vllm (8 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.11.0.
DescriptionCVE.org
A flaw was found in vLLM, an open-source library for large language model inference. This vulnerability arises from improper handling of image metadata, specifically EXIF orientation and PNG transparency (tRNS) data, during image processing. When images are converted to RGB, transparency information may be implicitly discarded or remapped, leading to unexpected rendering of transparent pixels and distortion of input content. This can result in the model misinterpreting image content, potentially affecting the integrity of processed data.
AnalysisAI
Image input manipulation in vLLM's multimodal preprocessing pipeline allows remote, unauthenticated network attackers to craft images with specific EXIF orientation or PNG tRNS transparency metadata that, when converted to RGB by vLLM, produces semantically altered image content fed to the LLM - affecting the integrity of inference outputs and potentially the reliability of the inference service. Affected deployments include Red Hat AI Inference Server across RHEL AI 3 and Red Hat OpenShift AI (RHOAI) environments. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; however, sensitive inference workloads processing user-supplied images (e.g., document classification, content moderation) face a higher practical risk from subtle input distortion attacks.
Technical ContextAI
vLLM is an open-source high-throughput inference engine for large language models that supports multimodal (vision-language) inputs. Its image preprocessing pipeline converts submitted images to RGB color space before tokenization and model ingestion. CWE-115 (Misinterpretation of Input) identifies the root cause class: metadata embedded in image formats is not explicitly validated or handled before conversion. EXIF orientation tags (tag 0x0112 in JPEG/TIFF) instruct compliant image readers to rotate or flip pixel data to achieve correct display orientation; when silently ignored during RGB conversion, the model receives geometrically incorrect pixel data. PNG tRNS chunks encode per-color or per-index transparency values; when the alpha channel is dropped during RGB compositing without a defined background, previously transparent pixels are assigned arbitrary colors, altering the visual content the model processes. The vulnerability manifests at the intersection of image format parsing and color-space normalization. Affected products per CPE data include cpe:2.3:a:red_hat:red_hat_ai_inference_server:*:*:*:*:*:*:*:* across multiple release lines.
RemediationAI
Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-12491 and the associated Bugzilla tracking ticket at https://bugzilla.redhat.com/show_bug.cgi?id=2489786 for vendor-released patch information; no exact fixed version number was confirmed in the available intelligence data, so patch status should be verified directly with Red Hat. If a vendor patch has not yet been applied, consider the following specific compensating controls: restrict image input sources to server-controlled or pre-vetted assets only, eliminating attacker-supplied EXIF and tRNS data at the ingestion boundary; introduce an explicit image normalization preprocessing step (e.g., using Pillow's ImageOps.exif_transpose and compositing transparency against a defined white or black background before submission to vLLM) to ensure deterministic RGB output regardless of embedded metadata; or, if multimodal vision capabilities are not operationally required, disable image inference endpoints entirely to eliminate the attack surface. Each mitigation carries trade-offs: metadata stripping may affect legitimate orientation-sensitive use cases; explicit compositing requires configuration of a background color policy; disabling endpoints removes vision functionality across all workloads.
More in Red Hat Ai Inference Server
View allPrivilege escalation in Red Hat Data Science Pipelines (DSP) allows an authenticated namespace editor to gain node-root
A remote attacker can trigger a heap out-of-bounds write in FFmpeg's DVD subtitle parser by providing a crafted MPEG-PS/
Same weakness CWE-115 – Misinterpretation of Input
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today