CVE-2026-12491

Name of the Vulnerable Software and Affected Versions vLLM (affected versions not specified)

Description An issue exists in the image processing logic where image metadata is improperly handled. Specifically, the software fails to call ImageOps.exif transpose() to normalize EXIF orientation, causing the model to process images in an orientation different from how they are viewed by humans. Additionally, PNG transparency data (tRNS) in P, L, or RGB modes is not explicitly flattened before being converted to RGB via image.convert("RGB"). This results in transparency information being implicitly discarded or remapped, which can render transparent pixels unexpectedly and distort input content. Furthermore, the system only loads the first frame when processing APNG or GIF files. These flaws can lead to the model misinterpreting image content and affecting the integrity of processed data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.