Dan-Sec-Ops

**Name of the Vulnerable Software and Affected Versions** vLLM versions 0.8.3 through 0.14.0 **Description** vLLM is an inference and serving engine for large language models (LLMs). A chain of issues allows for remote code execution (RCE) when a video model is enabled. First, sending an invalid image to the multimodal endpoint causes PIL to throw an error that vLLM returns to the client, leaking a heap address. This leak significantly reduces the effectiveness of Address Space Layout Randomization (ASLR), reducing potential guesses from 4 billion to approximately 8. This information leak can be chained with a heap overflow in the JPEG2000 decoder within OpenCV/FFmpeg. The overflow occurs when a malicious `cdef` box (a component used to remap color channels) forces the decoder to write a large Y (luma) plane into a smaller U (chroma) plane buffer. This allows an attacker to overwrite memory, such as function pointers in an `AVBuffer` structure, to execute arbitrary commands on the server. The issue affects the following API endpoints when a `video url` is provided in the content: - '/v1/chat/completions' - '/v1/invocations' **Recommendations** Update vLLM to version 0.14.1. As a temporary mitigation, avoid serving a video model or restrict access to the '/v1/chat/completions' and '/v1/invocations' endpoints.