vLLM Pillow decoder RCE: attacker-controlled image bytes dispatched to external renderer in the image path (CVE-2026-115915)

vLLM's image path fed attacker-controlled bytes to Pillow without restricting decoder selection, so a benign-looking image could be decoded by an external renderer (Ghostscript for EPS/PostScript) that vLLM did not intend to invoke, leading to code execution on hosts with a vulnerable Ghostscript, or worker exhaustion on Pillow 12.0.0–12.2.0. The fix (verified in commit 710ac56e) adds an image-format allowlist and rejects PostScript payloads. CVSS 8.1.

This is a remotely-triggerable RCE/disruption path in a core LLM serving engine: a single crafted image request is enough to reach the process's privileges or exhaust media workers. Multipart/multimodal serving is exposed by default in vLLM, so the blast radius is every deployment that accepts image input.

ImageMediaIO passes attacker-controlled image bytes to Pillow via Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request paths (parse_image/fetch_image) can therefore dispatch an EPS/PostScript payload to the host; a host with vulnerable Ghostscript executes commands with the vLLM process's privileges, while Pillow 12.0.0–12.2.0 triggers the media-loading worker exhaustion.

vLLM prior to 0.32.0. RCE depends on the host having Pillow-installed Ghostscript affected by CVE-2024-29510; worker-exhaustion depends on Pillow 12.0.0–12.2.0 (CVE-2026-59203).

Upgrade to vLLM 0.32.0 or later, which adds an allowlist of image formats (excluding EPS/WMF/BUFR/GRIB/HDF5/MPEG) so PostScript bytes never reach an external renderer; also ensure the GPU host's Pillow and Ghostscript are patched.