---
id: CVE-2026-22778
title: vLLM is an inference and serving engine for large language models (LLMs)
summary: >-
  vLLM is an inference and serving engine for large language models (LLMs). From
  0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal
  endpoint, PIL throws an error. vLLM returns this error to the client, leaking
  a hea…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-532
  - CWE-209
vendor: vllm
product: vllm
affected:
  - 'vllm >= 0.8.3, < 0.14.1'
patched:
  - vllm 0.14.1
published: '2026-02-02'
updated: '2026-06-29'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-22778'
references:
  - url: 'https://github.com/vllm-project/vllm/pull/31987'
    label: security-advisories@github.com
  - url: 'https://github.com/vllm-project/vllm/pull/32319'
    label: security-advisories@github.com
  - url: 'https://github.com/vllm-project/vllm/releases/tag/v0.14.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/vllm-project/vllm/security/advisories/GHSA-4r2x-xpjr-7cvv
    label: security-advisories@github.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:19712'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:30087'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:30088'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:30089'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:3461'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:3462'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:3713'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:3782'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/security/cve/CVE-2026-22778'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2436113'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22778.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-22778'
  - url: 'https://pypi.org/project/vllm'
  - url: 'https://github.com/vllm-project/vllm'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/vllm/PYSEC-2026-565.yaml
  - url: 'https://github.com/advisories/GHSA-4r2x-xpjr-7cvv'
tags:
  - nvd
  - exploit-available
  - osv
  - pip
epss: 0.03805
epssPercentile: 0.89562
ingestedAt: '2026-06-29T13:24:34.637Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/joaovicdev/EXPLOIT-CVE-2026-22778'
  nuclei:
    - CVE-2026-22778
  checkedAt: '2026-09-24T07:53:00.800Z'
exploitAvailable: true
aliases:
  - GHSA-4r2x-xpjr-7cvv
  - PYSEC-2026-565
ecosystem: pip
---

## Overview

vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an error. vLLM returns this error to the client, leaking a heap address. With this leak, we reduce ASLR from 4 billion guesses to ~8 guesses. This vulnerability can be chained a heap overflow with JPEG2000 decoder in OpenCV/FFmpeg to achieve remote code execution. This vulnerability is fixed in 0.14.1.

## Affected

- `vllm >= 0.8.3, < 0.14.1`

## Remediation

Upgrade past the affected range:

- `vllm 0.14.1`

## Package advisory (CVE-2026-22778)

Affected packages:

- `vllm >= 0.8.3, < 0.14.1`

Patched in:

- `vllm 0.14.1`

Source: https://osv.dev/vulnerability/GHSA-4r2x-xpjr-7cvv