langchain-openai EUVD-2026-25635

Exploitation requires that the target application accept attacker-controlled image URLs and route them through langchain-openai's get_num_tokens_from_messages function (or any call path that invokes _url_to_size()). The UI:R CVSS metric reflects that the application must actively process the submitted URL - typical in API endpoints that accept multimodal OpenAI-format chat payloads with image_url content blocks from untrusted users. Beyond application-level access, successful DNS rebinding requires attacker-operated DNS infrastructure with sub-second TTL control and favorable timing to win the race between the validation DNS query and the fetch DNS query; this is attacker-controllable but non-trivial to execute reliably. What limits exploitation: (1) the response body is consumed internally by Pillow and never surfaced, making this a blind probe rather than an exfiltration vector; (2) AC:H conditions mean automated, at-scale exploitation is not viable per SSVC automatable=no; (3) the attacker must know or guess internal host/port combinations to probe, providing no directory-style enumeration.

All available signals converge on a low-priority risk profile. The CVSS 3.1 base score of 3.1 (Low) is driven by AC:H - DNS rebinding demands attacker-controlled DNS infrastructure with sub-TTL timing precision - and C:L with I:N/A:N, reflecting that only blind inference is possible. EPSS at 0.03% (8th percentile) confirms the exploitation probability is negligible in the near term. SSVC rates exploitation as none, automatable as no, and technical impact as partial, meaning this does not meet the threshold for emergency remediation under standard prioritization frameworks. The vendor advisory explicitly caps the worst-case outcome at blind port probing based on timing or error behavior differences, since Pillow consumes the response internally without surfacing it. No conflicting signals are present: CVSS, EPSS, SSVC, and the absence from CISA KEV are mutually consistent. The primary mitigating factor is the response-body containment within Pillow - this is what prevents the classic SSRF data-exfiltration scenario and limits the vulnerability to a reconnaissance primitive against internal infrastructure.

An attacker registers a domain and configures its DNS with a TTL of 0-1 seconds, initially pointing to a legitimate public IP so that validate_safe_url() permits the request. The attacker immediately flips the DNS record to an internal address such as 192.168.1.1 or the cloud metadata endpoint 169.254.169.254 before the application's resolver issues the second lookup for the httpx.get() call, causing the fetch to reach an internal host. By observing whether the call returns quickly, times out, or raises a connection-refused error, the attacker can determine whether a given internal host and port are reachable - a blind port-scanning primitive against the application's internal network segment. No public proof-of-concept code is known at time of analysis.