CVE-2026-22778: vLLM leaks a heap address when PIL throws an error
Vulnerability summary
CVE-2026-22778 is a critical (CVSS 9.8) vulnerability in vllm-project vllm. EPSS estimates a 16.70% chance of exploitation in the next 30 days, higher than 97% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 02-02-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an error. vLLM returns this error to the client, leaking a heap address. With this leak, we reduce ASLR from 4 billion guesses to ~8 guesses. This vulnerability can be chained a heap overflow with JPEG2000 decoder in OpenCV/FFmpeg to achieve remote code execution. This vulnerability is fixed in 0.14.1.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · PypiEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
16.70%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
Increase +12.89 pp
From 3.81% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundvLLM Multimodal Heap-Address Information Leak Scanner
auxiliary/scanner/http/vllm_multimodal_info_leak
Maturity: poc
Weaknesses
CWE · root cause- CWE-532Insertion of Sensitive Information into Log FileThe product writes sensitive information to a log file.
- CWE-209Generation of Error Message Containing Sensitive InformationThe product generates an error message that includes sensitive information about its environment, users, or associated data.
Affected systems
Chainguard2 products
- tritonserver-backend-vllm-cuda-12.9< 25.9.0_git20251112-r7 | < 25.9.0_git20251112-r6 | < 25.9.0_git20260318-r0
- tritonserver-backend-vllm-cuda-13.0< 25.11-r2
PyPI1 product
- vllm≥ 0.8.3, < 0.14.1
Vllm1 product
- vllm≥ 0.8.3, < 0.14.1
Vllm-project1 product
- vllm≥ 0.8.3, < 0.14.1
4 vendors · 5 products
References
21 links- github.com/vllm-project/vllm/security/advisories/GHSA-4r2x-xpjr-7cvvX Refsource CONFIRMWEBAdvisoryVendor Advisory
Show all 21 references
- github.com/vllm-project/vllmPACKAGE