Log in Start free

Vulnerability · Published Feb 2, 2026 · Assigned by GitHub_M

CVE-2026-22778vLLM leaks a heap address when PIL throws an error

Critical 9.8

In plain English

A critical-severity sensitive data in logs in vllm from vllm-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 18.3% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)18.3%top 2.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling3Metasploit, Nuclei, Public PoC

Official description

vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an error. vLLM returns this error to the client, leaking a heap address. With this leak, we reduce ASLR from 4 billion guesses to ~8 guesses. This vulnerability can be chained a heap overflow with JPEG2000 decoder in OpenCV/FFmpeg to achieve remote code execution. This vulnerability is fixed in 0.14.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIvllm0.14.1GHSA-4r2x-xpjr-7cvv
PyPIvllm0.14.1PYSEC-2026-565

Affected products (as reported)

VendorProductVersions
vllm-project vllm >= 0.8.3, < 0.14.1

Weakness: CWE-532, CWE-209 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References