CVE-2026-22778

When an invalid image is uploaded to vLLM's multimodal endpoint, the PIL library raises an exception that vLLM returns directly to the client — exposing the process heap memory address in the error message content (CWE-532: exposure of sensitive information to logs/responses). Knowing the heap address, the attacker reduces the ASLR randomness space from approximately 4 billion possibilities to only about 8. The memory layout knowledge obtained this way allows the attacker to reliably conduct the second stage of the attack — an exploit leveraging a heap overflow (heap overflow) in the JPEG2000 decoder available through OpenCV or FFmpeg. The combination of both techniques enables remote code execution without any authentication.

An unauthenticated remote attacker can gain full control over the vLLM process, leading to confidentiality, integrity, and availability compromise of the system — including potential takeover of the host running LLM models.

Update vLLM to version 0.14.1 or later, where the vulnerability has been fixed. Details are available in the official project references and advisory GHSA-4r2x-xpjr-7cvv.

vLLM versions 0.8.3 through 0.14.0 (inclusive) — installations using multimodal endpoints that accept images are excluded.