Critical vLLM Multimodal Endpoint Flaw Enables Pre-Auth Remote Code Execution via Malicious Video

CVE-2026-22778 is a critical vulnerability in vLLM (an LLM inference/serving engine) that can enable remote code execution (RCE) when a server processes attacker-supplied multimodal content (e.g., a crafted video/image payload). The issue stems from vLLM returning a PIL error to the client when an invalid image is submitted to a multimodal endpoint, which leaks a heap address and dramatically weakens ASLR (reported as reducing brute-force from billions of guesses to ~8). This information disclosure can then be chained with a heap overflow in the JPEG2000 decoder within bundled OpenCV/FFmpeg components to hijack execution flow and run arbitrary commands on the host.

Operational risk is elevated because many default vLLM deployments (including common pip/Docker installs) may be exposed without authentication, and reporting indicates exploitation may still be possible pre-auth even when API keys are enabled (via an “invocations” route). The vulnerability affects versions 0.8.3 through < 0.14.1 and is fixed in vLLM 0.14.1; remediation should prioritize upgrading to >= 0.14.1 and reviewing exposure of multimodal endpoints, especially any internet-accessible instances.