CVE-2026-115912: vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonicid values in public multimodal features.kwargsdata. In scale-out deployments with shared-memory multimodal caching enabled, workers trust those values and pass attacker-selected bytes to pickle.loads(), allowing arbitrary Python execution even when insecure serialization is disabled. This issue is fixed in version 0.32.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vLLMto a version that resolves this vulnerability.Fixed in 0.32.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects vLLM versions prior to 0.32.0 when deployed in a scale-out configuration with shared-memory multimodal caching enabled. It is not described as affecting deployments without that shared-memory multimodal caching setup.
What access does an attacker need to exploit it?
An attacker must be an authenticated caller able to supply forged shared-memory address and monotonic_id values through public multimodal features.kwargs_data. Exploitation does not require user interaction, but the attack complexity is rated high.
Does disabling insecure serialization prevent exploitation?
No. The vulnerable worker path reaches pickle.loads() on attacker-selected bytes even when insecure serialization is disabled.
What is the available remediation?
Upgrade vLLM to version 0.32.0, which fixes the issue.