vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an error. vLLM returns this error to the client, leaking a heap address. With this leak, we reduce ASLR from 4 billion guesses to ~8 guesses. This vulnerability can be chained a heap overflow with JPEG2000 decoder in OpenCV/FFmpeg to achieve remote code execution. This vulnerability is fixed in 0.14.1.

The version of the vLLM Python package installed on the remote host is 0.8.3 prior to 0.14.1. It is, therefore, affected by an information disclosure vulnerability. When an invalid image is sent to the vLLM multimodal endpoint, PIL throws an error that vLLM returns to the client, leaking a heap address and largely defeating ASLR. This can be chained with a heap overflow in the JPEG2000 decoder used by OpenCV/FFmpeg to achieve remote code execution, but only against deployments serving a video model.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1,
    when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an error. vLLM returns this error
    to the client, leaking a heap address. With this leak, we reduce ASLR from 4 billion guesses to ~8
    guesses. This vulnerability can be chained a heap overflow with JPEG2000 decoder in OpenCV/FFmpeg to
    achieve remote code execution. This vulnerability is fixed in 0.14.1. (CVE-2026-22778)

ID	Name	Product	Family	Type	Severity
363842	vLLM 0.8.3 < 0.14.1 Information Disclosure (GHSA-4r2x-xpjr-7cvv)	Nessus	Artificial Intelligence	Local	critical
437416	SCA: security update for vllm (GHSA-4r2x-xpjr-7cvv)	Tenable Cloud Security	SCA Checks	Local	critical
437416	SCA: security update for vllm (GHSA-4r2x-xpjr-7cvv)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-22778

critical

Tenable Plugins

critical

critical

critical