AI Threat AlertvLLM before 0.32.0 hands attacker-supplied image bytes to Pillow without restricting which decoders it may use, so an EPS payload disguised as a normal image can be routed to host components such as Ghostscript. On hosts with a Ghostscript build affected by CVE-2024-29510, this can lead to command execution with the vLLM process's privileges; on Pillow 12.0.0 through 12.2.0 it can exhaust media-loading workers (CVE-2026-59203). Exploitation is rated high-complexity because it depends on the vulnerable dependency being present. There is no public exploit, no Nuclei template and no KEV listing, and EPSS data is not yet available. However, vLLM is widely deployed (94 downstream dependents, 176 other CVEs in the package) and multimodal endpoints are often exposed to untrusted users. Upgrade to vLLM 0.32.0, and until then check whether Ghostscript is installed and patched and whether Pillow is in the affected range.
What is the risk?
High (CVSS 8.1). The attack is network-reachable, needs no privileges and no user interaction, but complexity is high because impact depends on a vulnerable Ghostscript (CVE-2024-29510) or Pillow 12.0.0-12.2.0 being present. Exposure is greatest for internet-facing or multi-tenant multimodal endpoints that accept image URLs or uploads. There is no known active exploitation, no public PoC and no KEV listing, so near-term likelihood is moderate, but the pre-auth nature and the public patch make it easy to weaponize through patch diffing.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| vLLM | pip | < 0.32.0 | 0.32.0 |
Do you use vLLM? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade vLLM to 0.32.0 or later. 2) Check hosts and container images for Ghostscript and patch it to a version that fixes CVE-2024-29510, or remove it if it is not needed. 3) Upgrade Pillow out of the 12.0.0-12.2.0 range. 4) Until patched, restrict multimodal endpoints to authenticated, trusted clients, and block or filter EPS and other non-standard image formats at the gateway or WAF by checking magic bytes. 5) Run vLLM as an unprivileged user in a hardened container with seccomp/AppArmor profiles and egress restrictions. 6) Detect: alert on gs or other unexpected child processes spawned by the vLLM process, on spikes in media-loading worker failures or timeouts, and on image requests whose content does not match the declared MIME type.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-115915?
vLLM before 0.32.0 hands attacker-supplied image bytes to Pillow without restricting which decoders it may use, so an EPS payload disguised as a normal image can be routed to host components such as Ghostscript. On hosts with a Ghostscript build affected by CVE-2024-29510, this can lead to command execution with the vLLM process's privileges; on Pillow 12.0.0 through 12.2.0 it can exhaust media-loading workers (CVE-2026-59203). Exploitation is rated high-complexity because it depends on the vulnerable dependency being present. There is no public exploit, no Nuclei template and no KEV listing, and EPSS data is not yet available. However, vLLM is widely deployed (94 downstream dependents, 176 other CVEs in the package) and multimodal endpoints are often exposed to untrusted users. Upgrade to vLLM 0.32.0, and until then check whether Ghostscript is installed and patched and whether Pillow is in the affected range.
Is CVE-2026-115915 actively exploited?
No confirmed active exploitation of CVE-2026-115915 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-115915?
1) Upgrade vLLM to 0.32.0 or later. 2) Check hosts and container images for Ghostscript and patch it to a version that fixes CVE-2024-29510, or remove it if it is not needed. 3) Upgrade Pillow out of the 12.0.0-12.2.0 range. 4) Until patched, restrict multimodal endpoints to authenticated, trusted clients, and block or filter EPS and other non-standard image formats at the gateway or WAF by checking magic bytes. 5) Run vLLM as an unprivileged user in a hardened container with seccomp/AppArmor profiles and egress restrictions. 6) Detect: alert on gs or other unexpected child processes spawned by the vLLM process, on spikes in media-loading worker failures or timeouts, and on image requests whose content does not match the declared MIME type.
What systems are affected by CVE-2026-115915?
This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference, multimodal pipelines, OpenAI-compatible API gateways, GPU inference clusters.
What is the CVSS score for CVE-2026-115915?
CVE-2026-115915 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.66%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0010.001AI SoftwareAML.T0029Denial of AI ServiceAML.T0040AI Model Inference API AccessAML.T0049Exploit Public-Facing ApplicationAML.T0050Command and Scripting InterpreterCompliance Controls Affected
What are the technical details?
Original Advisory
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request paths through parse_image() and fetch_image() can therefore dispatch an EPS payload to host components. A host with Ghostscript affected by CVE-2024-29510 can execute commands with the vLLM process's privileges, while environments using Pillow 12.0.0 through 12.2.0 can trigger CVE-2026-59203 and exhaust media-loading workers. Deployments without the applicable vulnerable dependency are not affected by that corresponding impact. This issue is fixed in version 0.32.0.
Exploitation Scenario
An attacker finds a vLLM OpenAI-compatible endpoint that accepts image inputs, either by upload or by URL. They submit a request with a crafted EPS payload labelled as image/png, or host it on a URL for fetch_image() to retrieve. Pillow selects the EPS decoder from the content rather than the MIME label and passes the data to Ghostscript on the host. If Ghostscript is affected by CVE-2024-29510, the payload executes commands as the vLLM user. The attacker then steals API keys, model artifacts and cloud credentials, or moves laterally. Alternatively, a stream of malicious images ties up the media workers and takes down inference.
Weaknesses (CWE)
CWE-183Permissive List of Allowed InputsPrimaryCWE-183Permissive List of Allowed InputsPrimaryCWE-20Improper Input ValidationPrimaryCWE-20Improper Input ValidationPrimaryCWE-183Permissive List of Allowed InputsCWE-20Improper Input ValidationCWE-183 — Permissive List of Allowed Inputs: The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
- github.com/vllm-project/vllm/commit/710ac56e691d4713feca50a43e6c440f07d373fdx_refsource_MISC
- github.com/vllm-project/vllm/pull/60022x_refsource_MISC
- github.com/vllm-project/vllm/releases/tag/v0.32.0x_refsource_MISC
- github.com/vllm-project/vllm/security/advisories/GHSA-h3rc-j82p-2c3hx_refsource_CONFIRM
- github.com/advisories/GHSA-h3rc-j82p-2c3h
- nvd.nist.gov/vuln/detail/CVE-2026-115915
Timeline
Related Vulnerabilities
CVE-2026-6173210.0Decepticon: ChatML token injection yields sandbox RCE
Same package: vllmCVE-2024-110419.8vllm: RCE via unsafe pickle deserialization in MessageQueue
Same package: vllmCVE-2026-259609.8vllm: SSRF allows internal network access
Same package: vllmCVE-2025-472779.8vLLM: RCE via exposed TCPStore in distributed inference
Same package: vllmCVE-2024-90539.8vllm: RCE via unsafe pickle deserialization in RPC server
Same package: vllm