Zero Radar
← feed
HighVulnerabilityCVE-2026-115915updated 28 Oct 2026, 21:15 UTC

vLLM accepts disguised image files that can run commands on the server

vLLM trusts the file type label on uploaded images and can be tricked into handing a disguised file to a helper program. On a server with an old, vulnerable Ghostscript, that can let an attacker run commands with vLLM's permissions.

Fixed in vLLM 0.32.0Official, 2 sources
SeverityHighCVSS 8.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesvLLM 0.32.0 · since 28 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends imageDisguised EPS file labeled as PNG
  2. 2vLLM loads bytesMIME label does not restrict decoder
  3. 3Pillow picks EPSDetected by file signature
  4. 4Ghostscript runs payloadCVE-2024-29510 bypasses -dSAFER
  5. 5Commands executeRun with vLLM process privileges
  6. ResultAttacker runs commands on the server

What happened

vLLM before 0.32.0 lets attacker-controlled bytes select any Pillow-supported image decoder regardless of the declared MIME type. An EPS payload labeled image/png is sent to the host Ghostscript, which is exploitable via CVE-2024-29510 to escape its sandbox.

Why it is dangerous: An attacker who can send image requests to the vLLM server could execute commands with the vLLM process's privileges, and Pillow 12.0.0 through 12.2.0 can also be abused to exhaust media-loading workers.

Are you affected?

You are affected if you run vLLM older than 0.32.0 with an image-capable request path reachable by callers, and the host has a vulnerable Ghostscript build (CVE-2024-29510), or you use Pillow 12.0.0 through 12.2.0.

Package / productAffected versionsFixed in
vllm · pip< 0.32.00.32.0

What to do

  1. Update vLLM to 0.32.0 or later
  2. Update Ghostscript to 10.03.1 or later, or remove it if Pillow EPS support is not needed
  3. Upgrade Pillow to a version outside 12.0.0 through 12.2.0
  4. Restrict who can reach image-capable chat requests until patched

Timeline

  1. 26 Oct 2026, 18:17 UTC
    Publicly disclosed
  2. 26 Oct 2026, 18:17 UTC
    Reported by NVD · NVD
  3. 26 Oct 2026, 18:22 UTC
    Picked up by Zero Radar
  4. 28 Oct 2026, 21:15 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 28 Oct 2026, 21:15 UTC
    Fixed version published: vllm 0.32.0 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-115915 · GHSA-h3rc-j82p-2c3h
CVSS
8.1 / 10
EPSS
0.7% chance of exploitation within 30 days
Disclosed
26 Oct 2026, 18:17 UTC
On Zero Radar
26 Oct 2026, 18:22 UTC (5 min after disclosure)
Last change
28 Oct 2026, 21:15 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

vLLM accepts disguised image files that can run commands on the server · Zero Radar