CVE-2026-22778: vLLM: heap address leak through multimodal image error handling
CVE-2026-22778 affects vLLM from 0.8.3 before 0.14.1. According to the record, an invalid image sent to the multimodal endpoint causes an error that is returned to the client and reveals a heap address, which weakens ASLR. The record also states this leak can be chained with a heap overflow in an image decoder to reach remote code execution, and it assigns a critical CVSS 9.8 score.
Overview
CVE-2026-22778 is a vulnerability in vLLM, an inference and serving engine for large language models. According to the record, sending an invalid image to the multimodal endpoint causes an error from the Python Imaging Library (PIL) to be returned to the client, and that error exposes a heap memory address.
Impact
- Information disclosure: the record says the leaked heap address reduces the effort needed to defeat address space layout randomization (ASLR), from about four billion guesses to about eight.
- Possible chaining: the record states this leak can be combined with a heap overflow in a JPEG2000 decoder in OpenCV or FFmpeg to achieve remote code execution.
- Severity: the record assigns a critical CVSS 9.8 score, reflecting network reachability, no privileges required and no user interaction.
Affected products and versions
- Product: vLLM (listed in the record as Vllm Vllm).
- Affected range: from 0.8.3 up to, but not including, 0.14.1.
- Fixed in 0.14.1 according to the record.
- Patch pull requests listed in the record: PR 31987 and PR 32319.
Exploitation status
The CISA KEV catalog does not list this CVE according to the record. No confirmed active exploitation appears in the sources consulted. The record contains no EPSS score.
Remediation and mitigation
- Upgrade vLLM to 0.14.1 or later, the release the record identifies as fixed.
- Until the upgrade is complete, restrict access to the multimodal endpoint to trusted clients and networks, and require authentication where the deployment allows it.
- Confirm that image libraries used alongside vLLM, such as OpenCV or FFmpeg, are on current vendor releases, since the record links the chain to their decoders.
- Consult the vendor security advisory for further guidance.
Detection guidance
- Monitor requests to multimodal endpoints for malformed or unusual image payloads and for sudden increases in error responses.
- Review application logs for image-processing errors returned to external clients, which may indicate probing.
- Watch for unexpected crashes or restarts of inference worker processes.
Limitations of the available information
- The record does not include public exploit assessment, EPSS data or SSVC data.
- The record does not state whether the full remote code execution chain has been demonstrated publicly.
- The exact preconditions for the chain and whether older branches receive backports are not described.
- The record's CWE classification (CWE-532, insertion of sensitive information into a log file) may not fully describe client-facing error leakage.
Frequently asked questions
Which vLLM versions are affected?
The record lists versions from 0.8.3 up to, but not including, 0.14.1, and states the issue is fixed in 0.14.1.
Is this vulnerability being actively exploited?
The record shows the CVE is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted.
What should administrators do first?
Upgrade vLLM to 0.14.1 or later, and meanwhile restrict access to the multimodal endpoint to trusted clients and networks.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.