Improper Image Metadata Handling in vLLM

Executive Summary

CVE-2026-12491 is a vulnerability in the vLLM library, an open-source tool for large language model inference, caused by improper handling of image metadata during processing.

Specifically, the vulnerability arises because the EXIF orientation data in images is not normalized after loading, and PNG images with tRNS transparency are not properly flattened before conversion to RGB.

As a result, transparent or semi-transparent pixels may be rendered unexpectedly, causing the model to misinterpret the visual content of images, which can distort the input data.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing the vLLM model to misinterpret image content due to unexpected rendering of transparent pixels and distorted input data.

Such misinterpretation can affect the integrity of the processed data, potentially leading to incorrect outputs or decisions based on flawed image inputs.

The issue affects all Linux environments using the vLLM library and has a medium severity rating.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability arises from improper handling of image EXIF orientation and PNG tRNS transparency in the vLLM library during image processing.

To detect if your system is affected, you should check if the vLLM library is installed and used in your environment, especially on Linux systems.

Since the issue relates to image processing, you can test by processing images with EXIF rotation or PNG transparency through vLLM and observe if the output images or model interpretations are distorted or incorrect.

There are no specific commands provided in the resources to detect this vulnerability directly on your network or system.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves ensuring that the vLLM library properly normalizes image EXIF orientation and explicitly flattens PNG transparency before conversion to RGB.

Specifically, the vulnerability is caused by the absence of a call to ImageOps.exif_transpose to normalize EXIF orientation and improper handling of PNG tRNS transparency in non-RGBA modes.

Until a patch or update is applied, avoid processing images with EXIF rotation or PNG transparency through vLLM or preprocess images to normalize EXIF orientation and flatten transparency manually.

Monitor for updates or patches from the vLLM maintainers or your Linux distribution to apply fixes addressing this issue.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0