CVE-2026-22778criticalCWE-209CWE-532

CVE-2026-22778: critical vulnerability in vllm-project vllm

vLLM leaks a heap address when PIL throws an error

Published · Updated

Follow this CVE+ Monitor vllm+ Monitor vllm

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 9.8epss 18%
from disclosure to weaponsame day
Published on NVDFeb 2
metasploitFeb 2
In short

vLLM leaks a memory address when processing invalid images, which helps attackers bypass a security protection (ASLR) and can lead to remote code execution when combined with other vulnerabilities.

Technical detail

When PIL encounters an invalid image on vLLM's multimodal endpoint (versions 0.8.3–0.14.0), the error message containing a heap address is returned to the client, reducing ASLR entropy from 2^32 to ~8 possibilities. This information disclosure can be chained with heap overflow vulnerabilities in image decoders (JPEG2000 in OpenCV/FFmpeg) to achieve RCE.

Summary generated and translated by AI from the official description.
vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an error. vLLM returns this error to the client, leaking a heap address. With this leak, we reduce ASLR from 4 billion guesses to ~8 guesses. This vulnerability can be chained a heap overflow with JPEG2000 decoder in OpenCV/FFmpeg to achieve remote code execution. This vulnerability is fixed in 0.14.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
vllm-project · vllm
Related CVEs — vllm-project vllm

In the same product, most dangerous first.

CVE-2025-32444CRITICALvLLM Vulnerable to Remote Code Execution via Mooncake IntegrationEPSS 1.8%CVE-2026-27893HIGHvLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-outEPSS 1.4%CVE-2026-48746CRITICALvLLM: OpenAI auth bypassEPSS 1.2%CVE-2026-22807HIGHvLLM affected by RCE via auto_map dynamic module loading during model initializationEPSS 1.0%CVE-2025-47277CRITICALvLLM Allows Remote Code Execution via PyNcclPipe Communication ServiceEPSS 1.0%CVE-2025-62164HIGHVLLM deserialization vulnerability leading to DoS and potential RCEEPSS 1.0%