Vulnerabilities

Vulnerability · CVE-2026-115915

vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE

Published Oct 26, 2026 · catalog updated Oct 28, 2026 · Red Hat Red Hat Enterprise Linux

Last checked Nov 4, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-115915. EPSS is 0.66%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.

Severity

High8.1

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.66%

Remediation

Version ranges on file

Affected products

pip vllm

### Summary In vLLM 0.30.0, passes attacker-controlled image bytes to Pillow's format autodetection without restricting the accepted formats; the request's MIME label does not constrain decoder selection. An EPS payload labeled reached the host's Ghostscript executable. On a host with Ghostscript affected by CVE-2024-29510, this exposes the known Ghostscript sandbox escape through vLLM's image-loading path and can execute commands with the vLLM process's privileges. A bounded marker-command payload executed through the PyPI wheel's actual implementation using Debian Ghostscript 10.03.0. The loader-level execution is reproduced; the HTTP request path is source-traced but was not exercised end to end. This report concerns vLLM's untrusted-format dispatch and does not claim a new Ghostscript vulnerability. Exploitation requires an image-capable request path, a caller able to reach it under the deployment's authentication policy, and a vulnerable host Ghostscript build. ### Details is the boundary where attacker-controlled bytes enter Pillow's format autodetection: the declared MIME type does not constrain decoder selection, and the loader calls without a Pillow format allowlist. Pillow recognizes EPS by its file signature, and vLLM's subsequent call enters Pillow's EPS processing path. The OpenAI chat multimodal parser reaches this path through [ and ](https://github.com/vllm-project/vllm/blob/bc21cba9673cfc2256a2726b4bc32f062237cd35/vllm/entrypoints/chat_utils.py#L1077-L1081) and the [media connector](https://github.com/vllm-project/vllm/blob/bc21cba9673cfc2256a2726b4bc32f062237cd35/vllm/multimodal/media/connector.py#L367-L402); the data URL path extracts the MIME label and forwards the bytes to the loader ([source](https://github.com/vllm-project/vllm/blob/bc21cba9673cfc2256a2726b4bc32f062237cd35/vllm/multimodal/media/connector.py#L319-L332)). This is the vLLM-specific issue: untrusted image bytes can select a Pillow-supported format parser. Each downstream impact de