External risk intelligence

vLLM Image Processing Vulnerability Allows Host Command Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-115915

vLLM is an inference and serving engine designed for LLMs, typically deployed as an internet-facing API or web service to provide model serving capabilities. Because these services are commonly exposed to handle incoming user requests for image and text processing, the vulnerable request paths are frequently reachable from the internet.

Vllm

0.30.0 to before 0.32.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical vulnerability in the vLLM large language model engine. The issue lies in how image data is processed, potentially allowing an attacker to execute commands on the host system or cause denial-of-service conditions by manipulating image inputs. This matters because vLLM is often used in internet-facing applications, making these systems a target. The main concern is confirming relevance and exposure.

Image processing flaws can allow attackers to run code.
Critical vulnerability affects internet-facing AI services.
Confirm if your vLLM deployment is exposed.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted image data to vLLM. The affected component, ImageMediaIO, does not properly validate this data, allowing an attacker to bypass format restrictions and trigger the execution of malicious code or resource exhaustion. This could lead to unauthorized command execution or denial of service on the host system.

No authentication or user interaction needed.
Image parsing functions in request paths.
Command execution or resource exhaustion.

Live Threat

Current exploitation, exposure, and threat context

In affected vLLM deployments, specially crafted image data sent to image-capable request paths could lead to the execution of arbitrary commands on the host system with the privileges of the vLLM process, or cause denial-of-service conditions by exhausting media-loading workers.

Host command execution
Malicious image processing
Arbitrary code execution

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects vLLM, an inference and serving engine for large language models. Application owners or platform teams responsible for vLLM deployments should first identify all instances of the affected technology, determine their reachability and business criticality, and then pinpoint the accountable owner for remediation planning.

Identify vLLM instances and owners.
Verify reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is vLLM and how is it used?

vLLM is a high-performance software engine designed to serve and run large language models. Developers use it to build APIs that allow applications to interact with AI models, enabling them to process both text and images for various generative tasks.

What does CVE-2026-115915 mean for security?

This vulnerability involves improper input validation, specifically identified as CWE-20 and CWE-183. It means the software fails to properly check image data before processing it. Because it does not verify the file format or restrict how images are decoded, the system can be tricked into treating malicious data as legitimate commands or triggers for other installed tools.

How can an attacker trigger this bug?

An attacker triggers this by sending a specially crafted image file to an image-capable request path in vLLM. It is important to note that sending a standard, non-malicious image will not trigger this issue; the vulnerability requires an input designed to exploit the lack of format restrictions within the software's internal image-handling components.

Do I need to worry if my vLLM instance is internal?

Halo Surface Signal indicates that vLLM is typically deployed as an internet-facing service to handle requests. While the risk is highest for services directly exposed to the internet, you should evaluate if your specific internal architecture allows untrusted users to send image data to these processing paths, as the vulnerability is reachable through any image-capable request.

When should I update my vLLM deployment?

You should plan to update immediately. As a first step, verify if you are running a version between 0.30.0 and 0.32.0. If you are, identify the specific instances of vLLM in your environment, determine their accessibility, and upgrade to version 0.32.0 or later to ensure the image processing logic is properly secured.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.