PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-22778 vllm-project CVE debrief

CVE-2026-22778 is a critical vulnerability in vLLM, a large language model inference and serving engine. The vulnerability allows for information disclosure and potential remote code execution. From version 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an error, which is then returned to the client, leaking a heap address. This leak reduces ASLR from 4 billion guesses to approximately 8 guesses. The vulnerability can be chained with a heap overflow in the JPEG2000 decoder in OpenCV/FFmpeg to achieve remote code execution. The vulnerability is fixed in version 0.14.1.

Vendor
vllm-project
Product
vllm
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-02
Original CVE updated
2026-07-15
Advisory published
2026-02-02
Advisory updated
2026-07-15

Who should care

Organizations using vLLM for large language model inference and serving should prioritize patching this vulnerability. The vulnerability's critical severity and potential for remote code execution make it a high-risk issue. Additionally, defenders should review their inventory of affected systems and monitor for potential exploitation attempts.

Technical summary

The vulnerability exists in vLLM's multimodal endpoint, where an invalid image triggers an error in PIL, leading to a heap address leak. This leak significantly weakens ASLR, making it easier for attackers to exploit the system. The vulnerability can be exploited remotely, and its critical severity score of 9.8 indicates a high risk to affected systems. The fix in version 0.14.1 addresses the issue by properly handling errors and preventing information disclosure.

Defensive priority

Patching to version 0.14.1 is the primary recommended action. Additionally, defenders should review their system inventory, monitor for exploitation attempts, and consider implementing compensating controls to mitigate potential risks.

Recommended defensive actions

  • Patch vLLM to version 0.14.1 or later
  • Review inventory of affected systems
  • Monitor for potential exploitation attempts
  • Implement compensating controls to mitigate risks
  • Verify error handling in multimodal endpoint
  • Update OpenCV/FFmpeg to prevent heap overflow chaining

Evidence notes

The CVE record and NVD detail provide official information on the vulnerability. The source item URL provides additional context from the NVD database. Vendor references, including GitHub pull requests and release notes, offer insights into the fix and mitigation strategies.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-22778 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-22778

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-22778 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-22778

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.