CVE-2026-115912highCode execution2026-10-26

CVE-2026-115912: vLLM 0.32.0 fixes a forged shared-memory handle that reaches pickle.loads, EPS images that can reach Ghostscript, and five ways to stall or crash the server

Eight vLLM CVEs were published on 26 October 2026, all fixed in vLLM 0.32.0. The worst lets an authenticated caller forge a multimodal shared-memory handle so a worker runs pickle.loads() on attacker bytes, even with insecure serialization disabled. Another lets an image request hand an EPS file to Ghostscript. The rest let a caller hang or crash a shared server. Upgrade to 0.32.0.

01.

What it is

CVE-2026-115912 (GHSA-6757-hggm-hp2w, code execution): in scale-out deployments with the shared-memory multimodal cache on (--mm-processor-cache-type shm), workers trust the address and monotonic_id values a caller puts in features.kwargs_data. An authenticated caller can point them at bytes they staged, and the worker passes those bytes to pickle.loads(), which allows arbitrary Python execution even when VLLM_ALLOW_INSECURE_SERIALIZATION is off. The advisory confirmed it on 0.25.1.

CVE-2026-115915 (GHSA-h3rc-j82p-2c3h): ImageMediaIO lets Pillow pick the decoder from the file bytes, ignoring the MIME label, so an EPS payload labelled image/png reaches the host's Ghostscript. On a host with a Ghostscript build affected by CVE-2024-29510 this can run commands as the vLLM process; with Pillow 12.0.0 to 12.2.0 it can trigger CVE-2026-59203 and exhaust media workers. Hosts without those vulnerable dependencies don't get that impact.

CVE-2026-115911 and CVE-2026-115918 (GHSA-542m-9234-8gvf, GHSA-x567-49g5-p4cf): when no server-side chat template is set, a caller (or a malicious model repo) can supply a Jinja chat template that is rendered with no time, size or loop limit, blocking /v1/responses and other chat-template users or exhausting memory. On /v1/responses the template could be passed in chat_template_kwargs even without trust_request_chat_template. Harmony models aren't affected.

CVE-2026-115913, CVE-2026-115914 and CVE-2026-115916 (engine crashes for every user): one long audio clip makes the Phi-4 multimodal audio encoder use quadratic GPU memory; an image whose normalized pixels sum to zero trips a fatal assertion in the DeepSeek-OCR, DeepSeek-OCR-2 and Unlimited-OCR path; and an off-by-one lets a pre-tokenized prompt ID equal to the vocabulary size crash the engine with a CUDA assertion.

CVE-2026-115917 (low): the OpenAI-compatible server allowed any CORS origin by default, so a malicious web page could use a visitor's browser to call an unauthenticated vLLM server on localhost, an internal network or a VPN and read the replies.

Six medium vLLM CVEs published on 25 October (CVE-2026-116172, 116173, 116174, 116175, 116178, 116181) cover gRPC input-validation bypasses, an audio decompression bomb and engine crashes fixed in releases 0.24.0 to 0.30.0, so upgrading to 0.32.0 covers them too.

02.

How to check

Affected: vllm (PyPI) before 0.32.0. Version ranges differ per CVE (for example 0.19.0 and later for the chat-template bug, 0.11.1 and later for the DeepSeek-OCR crash).
You are most exposed if untrusted users share your vLLM server, you run scale-out deployments with the shm multimodal cache, you accept image, audio or video input, or you run vLLM without an API key on a network a browser can reach.

03.

How to fix

Upgrade vllm to 0.32.0 or later.
Until then, keep API keys on, set a server-side --chat-template, don't enable the shm multimodal cache for untrusted callers, make sure the host's Ghostscript is patched (or not installed), and restrict CORS to your own origins.

pip show vllm | grep -i version
pip install -U 'vllm>=0.32.0'

04.

Sources

More advisories for this tool