Heap Address Leak in vLLM Multimodal Endpoint Enables RCE

Publication date: 2026-02-02

Last updated on: 2026-06-29

Assigner: GitHub, Inc.

Description

vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an error. vLLM returns this error to the client, leaking a heap address. With this leak, we reduce ASLR from 4 billion guesses to ~8 guesses. This vulnerability can be chained a heap overflow with JPEG2000 decoder in OpenCV/FFmpeg to achieve remote code execution. This vulnerability is fixed in 0.14.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-02

Last Modified

2026-06-29

Generated

2026-07-06

AI Q&A

2026-02-03

EPSS Evaluated

2026-07-05

NVD

CVE-2026-22778

Affected Vendors & Products

Vendor	Product	Version / Range
vllm	vllm	From 0.8.3 (inc) to 0.14.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-532	The product writes sensitive information to a log file.
CWE-209	The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

Executive Summary

This vulnerability exists in vLLM versions from 0.8.3 to before 0.14.1. When an invalid image is sent to vLLM's multimodal endpoint, the Python Imaging Library (PIL) throws an error. vLLM returns this error to the client, which leaks a heap address. This leak significantly reduces the effectiveness of Address Space Layout Randomization (ASLR) from about 4 billion guesses to approximately 8 guesses. An attacker can chain this information leak with a heap overflow vulnerability in the JPEG2000 decoder of OpenCV/FFmpeg to achieve remote code execution. The vulnerability is fixed in version 0.14.1.

Mitigation Strategies

Upgrade vLLM to version 0.14.1 or later, where this vulnerability is fixed. Avoid sending invalid images to the vLLM multimodal endpoint until the update is applied.

Impact Analysis

This vulnerability can lead to remote code execution on systems running vulnerable versions of vLLM. By leaking a heap address, it allows attackers to bypass ASLR protections, making it easier to exploit a heap overflow in the JPEG2000 decoder of OpenCV/FFmpeg. Successful exploitation could allow attackers to execute arbitrary code remotely, potentially compromising the affected system's confidentiality, integrity, and availability.

Hi! I’m here to help you understand CVE-2026-22778. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70