Vulnerabilities

Vulnerability · CVE-2026-115912

vLLM: Public multimodal SHM handle forgery reaches worker-side with insecure serialization disabled

Published Oct 26, 2026 · catalog updated Oct 28, 2026 · Red Hat Red Hat Enterprise Linux

Last checked Nov 4, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-115912. EPSS is 0.51%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.

Severity

High7.5

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.51%

Remediation

Version ranges on file

Affected products

pip vllm

## Affected - **Ecosystem / package:** pip / - **Affected versions:** vLLM < 0.32.0. ## Summary When is enabled, vLLM's multimodal SHM cache represents a cached item with an and pair and treats that pair as authority to dereference shared memory in the worker. A public scale-out request can supply its own multimodal , so an authenticated caller can forge an inner SHM carrier that points at attacker-controlled bytes already staged in the ring buffer. The worker then reaches while deserializing the forged object. This is reachable through ordinary public HTTP routes and does not require . The live chain used to obtain a valid feature envelope, to stage attacker-chosen bytes into SHM, and to submit the forged inner carrier. ## Affected code Links pinned to the confirmed commit [ ](https://github.com/vllm-project/vllm/tree/752a3a504485790a2e8491cacbb35c137339ad34) (v0.25.1): - [ ](https://github.com/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/distributed/device_communicators/shm_object_storage.py#L375-L400) — SHM object deserialization reaches for byte objects. - [ ](https://github.com/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/multimodal/cache.py#L567-L581) — sender emits an SHM carrier containing only and . - [ ](https://github.com/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/multimodal/cache.py#L711-L737) — worker dereferences the untrusted pair and reads the SHM object. - [ ](https://github.com/vllm-project/vllm/blob/752a3a504485790a2e8491cacbb35c137339ad34/vllm/entrypoints/scale_out/token_in_token_out/serving.py#L146-L173) — public is decoded into engine input without authenticating SHM handles before handoff. The public scale-out route decodes attacker-controlled into s and hands them straight to the engine — no authentication of the SHM handle: In the worker, a decoded item that carries an is treated as authority to dereference shared memory: the pair alone drives the read, with no binding