What happened
NVD published this CVSS 6.5 Medium vulnerability on Sept 16, 2026 describing a configuration-override flaw in vLLM's video media-handling pipeline.
Why it matters
Allowing clients to override server-selected media decode backends undermines an operator's ability to restrict which decoding libraries (and their associated attack surface) are used, particularly relevant given the concurrent audio-decode DoS issues affecting the same media pipeline.
Attack vector
Request bodies can set media_io_kwargs.video.video_backend to pynvvideocodec, and MediaConnector.fetch_video forwards that client-supplied choice to VideoMediaIO even when the server operator's startup configuration selected a different, presumably safer, backend.
Affected systems
vLLM < 0.28.0
Mitigation
Upgrade to vLLM >= 0.28.0, which enforces the server-configured video backend regardless of client-supplied values.