CVE-2026-115915 — vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE

Affected: vllm-project vllm

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request paths through parse_image() and fetch_image() can therefore dispatch an EPS payload to host components. A host with Ghostscript affected by CVE-2024-29510 can execute commands with the vLLM process's privileges, while environments using Pillow 12.0.0 through 12.2.0 can trigger CVE-2026-59203 and exhaust media-loading workers. Deployments without the applicable vulnerable dependency are not affected by that corresponding impact. This issue is fixed in version 0.32.0.

GHSA-h3rc-j82p-2c3h — vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE

Affected: PyPI: vllm

### Summary

In vLLM 0.30.0, `ImageMediaIO` passes attacker-controlled image bytes to Pillow's format autodetection without restricting the accepted formats; the request's MIME label does not constrain decoder selection. An EPS payload labeled `image/png` reached the host's Ghostscript executable. On a host with Ghostscript affected by CVE-2024-29510, this exposes the known Ghostscript sandbox escape through vLLM's image-loading path and can execute commands with the vLLM process's privileges. A bounded marker-command payload executed through the PyPI wheel's actual `ImageMediaIO.load_base64()` implementation using Debian Ghostscript 10.03.0. The loader-level execution is reproduced; the HTTP request path is source-traced but was not exercised end to end. This report concerns vLLM's untrusted-format dispatch and does not claim a new Ghostscript vulnerability. Exploitation requires an image-capable request path, a caller able to reach it under the deployment's authentication policy, and a vulnerable host Ghostscript build.

### Details

`ImageMediaIO` is the boundary where attacker-controlled bytes enter Pillow's format autodetection: the declared MIME type does not constrain decoder selection, and the loader calls `Image.open(BytesIO(data))` without a Pillow format allowlist. Pillow recognizes EPS by its file signature, and vLLM's subsequent `image.load()` call enters Pillow's EPS processing path. The OpenAI chat multimodal parser reaches this path through [`parse_image()` a…

Most recent entries from all

CVE-2026-115915 — vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE

GHSA-h3rc-j82p-2c3h — vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE