Loading vulnerability…
CVE-2026-22778 is an information disclosure vulnerability in vLLM affecting multimodal/OpenAI-compatible endpoints in versions 0.8.3 through 0.14.0. When a client submits an invalid image to a multimodal endpoint such as /v1/chat/completions, Pillow/PIL raises an UnidentifiedImageError. vLLM returns the raw exception text to the client, and that error string can include the Python representation of an in-memory BytesIO object, e.g. '<_io.BytesIO object at 0x...>', thereby disclosing a heap address. The leak weakens ASLR substantially and is described in the provided content as the first stage of a larger exploitation chain involving a JPEG2000 heap overflow in OpenCV/FFmpeg that could lead to remote code execution. The issue was fixed in vLLM 0.14.1 by sanitizing returned error messages.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This six-file repository contains a standalone Python proof of concept and a Dockerized vulnerable lab for a claimed two-stage vLLM multimodal-media attack chain. exploit.py uses only Python standard-library modules. It first sends invalid image content to an unauthenticated vLLM-compatible API endpoint and extracts a leaked BytesIO object address from the returned Pillow exception. It then builds a malicious JPEG2000/JP2 payload from scratch and delivers it as a data URL or through a temporary attacker-controlled HTTP server. The JP2 cdef box maps a full-resolution component onto a subsampled destination plane, exercising CVE-2025-9951 in FFmpeg 5.1.x through OpenCV VideoCapture. The PoC monitors /health boot_id values to distinguish a target crash/restart from a patched target. It is a crash/memory-corruption PoC, despite the repository's RCE framing: no reliable control-flow hijack or command-execution payload is implemented. lab/app.py is a FastAPI reimplementation of the relevant vLLM ingestion paths, with image loading through Pillow, video loading through cv2.VideoCapture, verbatim exception exposure, /v1/chat/completions and /v1/invocations routes, and a diagnostic /health route. The Docker configuration builds this lab with Python 3.11, FastAPI/Uvicorn, Pillow 11.1.0, and opencv-python-headless 4.11.0.86; docker-compose publishes port 8000 and restarts the container after the expected decoder-induced abort.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An information disclosure vulnerability in vLLM OpenAI-compatible multimodal servers where a malformed image can trigger Pillow to leak a BytesIO heap address in an error response, described as the ASLR-bypassing first stage of a JPEG2000 heap-overflow RCE chain.
An information disclosure vulnerability in vLLM multimodal handling that leaks heap memory addresses via error output or object representations, aiding attackers by exposing memory layout details.
An earlier vLLM vulnerability whose original fix was incomplete, leading to CVE-2026-54236.
A remote code execution (RCE) vulnerability in vLLM triggered via a malicious video URL.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.