Loading vulnerability…
vLLM multimodal heap-address disclosure enabling an RCE chain
CVE-2026-22778 affects vLLM versions 0.8.3 through 0.14.0. Submitting an invalid image to a multimodal endpoint causes Pillow to raise an exception containing a Python BytesIO object's heap address. vLLM returns the exception text to the client without adequately sanitizing it, disclosing process memory layout and weakening ASLR. The disclosure can be chained with a heap overflow in JPEG2000 decoding through OpenCV/FFmpeg to achieve remote code execution in deployments serving video models. Version 0.14.1 fixes the original issue.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The direct impact is disclosure of a process heap address, providing an ASLR-bypass primitive. The disclosed address reportedly reduces the relevant address-guessing space from approximately four billion possibilities to approximately eight. When combined with the vulnerable JPEG2000 decoding path in a video-model deployment, the leak can enable unauthenticated or pre-authentication arbitrary command execution on the server. The information leak alone does not establish code execution.
If you can’t patch tonight, do this now.
Until patched, avoid serving video models on vulnerable versions and restrict or disable processing of untrusted remote video URLs. Limit outbound retrieval and restrict access to multimodal endpoints through network controls. Enable authentication, but do not rely on it alone because the invocations route may permit pre-authentication exploitation. Sanitize exception messages before returning them to clients, including exception-handling paths not covered by the original fix.
Patch, then assume compromise.
Upgrade vLLM to version 0.14.1 or later to address the original vulnerability, including the fixes associated with pull requests #31987, #32319, and #32668. A separately tracked incomplete-fix issue leaves additional Anthropic-compatible and speech-to-text exception paths exposed; upgrade to version 0.24.0 or later to address that follow-up issue as well.
1 exploit validated by Mallory's analysis. Hidden: 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.