CVE-2026-115915: vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request paths through parseimage() and fetchimage() can therefore dispatch an EPS payload to host components. A host with Ghostscript affected by CVE-2024-29510 can execute commands with the vLLM process's privileges, while environments using Pillow 12.0.0 through 12.2.0 can trigger CVE-2026-59203 and exhaust media-loading workers. Deployments without the applicable vulnerable dependency are not affected by that corresponding impact. This issue is fixed in version 0.32.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vLLMto a version that resolves this vulnerability.Fixed in 0.32.0
Event History
Frequently Asked Questions
Which deployments face remote code execution versus denial of service?
Remote code execution requires the host to have Ghostscript affected by CVE-2024-29510; commands run with the vLLM process's privileges. Denial of service through media-loading worker exhaustion applies when Pillow 12.0.0 through 12.2.0 is present. A deployment lacking the relevant vulnerable dependency is not affected by that corresponding impact.
What does an attacker need to exploit this issue?
An attacker needs access to an image-capable request path that reaches parse_image() or fetch_image() and can supply attacker-controlled image bytes. No privileges or user interaction are required, but exploitation has high attack complexity.
Are MIME-type checks sufficient to prevent malicious EPS processing?
No. The MIME label does not constrain the format selected by Pillow, and ImageMediaIO does not restrict decoder selection when opening the supplied bytes. An EPS payload can therefore be dispatched to host components despite its MIME label.
What is the remediation?
Upgrade vLLM to version 0.32.0, which fixes the issue. Also determine whether the host has vulnerable Ghostscript or Pillow 12.0.0 through 12.2.0, as those dependencies determine the applicable impact.