CVE-2026-22778Critical· 9.8▾ AbyssalPoC availablevLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an error. vLLM returns this error to the client, leaking a hea…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 53.9 · likelihood 0.8 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
3.8%
1 GitHub repo · Nuclei ×1
vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an error. vLLM returns this error to the client, leaking a heap address. With this leak, we reduce ASLR from 4 billion guesses to ~8 guesses. This vulnerability can be chained a heap overflow with JPEG2000 decoder in OpenCV/FFmpeg to achieve remote code execution. This vulnerability is fixed in 0.14.1.
vllm >= 0.8.3, < 0.14.1Upgrade past the affected range:
vllm 0.14.1Affected packages:
vllm >= 0.8.3, < 0.14.1Patched in:
vllm 0.14.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-22807High· 8.8vLLM is an inference and serving engine for large language models (LLMs)
CVE-2026-48746Critical· 9.1vLLM is an inference and serving engine for large language models (LLMs)
CVE-2026-54236Medium· 5.3vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router
CVE-2026-73555Medium· 5.3vLLM is an inference and serving engine for large language models
CVE-2026-24779High· 7.1vLLM is an inference and serving engine for large language models (LLMs)
CVE-2026-34753Medium· 5.4vLLM: Server-Side Request Forgery (SSRF) in `download_bytes_from_url `