PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-12491 Red Hat CVE debrief

The CVE-2026-12491 vulnerability in vLLM, an open-source library for large language model inference, arises from improper handling of image metadata. Specifically, EXIF orientation and PNG transparency (tRNS) data are not correctly processed when images are converted to RGB. This can lead to unexpected rendering of transparent pixels and distortion of input content, potentially affecting the integrity of processed data. The vulnerability has a CVSS score of 4.8 and is classified as MEDIUM severity. Organizations using vLLM for image processing should be aware of this issue and take necessary precautions.

Vendor
Red Hat
Product
Red Hat AI Inference Server
CVSS
MEDIUM 4.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-06-17
Advisory published
2026-06-17
Advisory updated
2026-06-17

Who should care

Organizations utilizing vLLM for large language model inference, especially those processing images with metadata, should be aware of this vulnerability. This includes developers and users of vLLM in various applications, particularly where image content integrity is crucial.

Technical summary

The vulnerability is caused by improper handling of image metadata, specifically EXIF orientation and PNG transparency (tRNS) data, during image processing in vLLM. When images are converted to RGB, transparency information may be implicitly discarded or remapped, leading to unexpected rendering of transparent pixels and distortion of input content. This can result in the model misinterpreting image content, potentially affecting the integrity of processed data. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L.

Defensive priority

MEDIUM

Recommended defensive actions

  • Update vLLM to the latest version that addresses this vulnerability.
  • Review and validate image processing workflows to ensure correct handling of metadata.
  • Implement additional validation and sanitization of image metadata before processing.
  • Monitor for and respond to potential distortions in image content.
  • Consider using alternative libraries or workarounds until an official fix is available.
  • Engage with the vLLM community for updates and patches related to this issue.

Evidence notes

The information provided is based on data from the National Vulnerability Database (NVD) and Red Hat security advisories. The CVE record and NVD detail pages provide official information about the vulnerability. Red Hat security advisories offer additional context and potential mitigations.

Official resources

public