CVE-2026-22778

Name of the Vulnerable Software and Affected Versions vLLM versions 0.8.3 through 0.14.0

Description vLLM is an inference and serving engine for large language models (LLMs). A chain of issues allows for remote code execution (RCE) when a video model is enabled. First, sending an invalid image to the multimodal endpoint causes PIL to throw an error that vLLM returns to the client, leaking a heap address. This leak significantly reduces the effectiveness of Address Space Layout Randomization (ASLR), reducing potential guesses from 4 billion to approximately 8.

This information leak can be chained with a heap overflow in the JPEG2000 decoder within OpenCV/FFmpeg. The overflow occurs when a malicious cdef box (a component used to remap color channels) forces the decoder to write a large Y (luma) plane into a smaller U (chroma) plane buffer. This allows an attacker to overwrite memory, such as function pointers in an AVBuffer structure, to execute arbitrary commands on the server.

The issue affects the following API endpoints when a video url is provided in the content:

Recommendations Update vLLM to version 0.14.1. As a temporary mitigation, avoid serving a video model or restrict access to the '/v1/chat/completions' and '/v1/invocations' endpoints.