CVE

CVE-2026-22778

9.8

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an error. vLLM returns this error to the client, leaking a heap address. With this leak, we reduce ASLR from 4 billion guesses to ~8 guesses. This vulnerability can be chained a heap overflow with JPEG2000 decoder in OpenCV/FFmpeg to achieve remote code execution. This vulnerability is fixed in 0.14.1.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

vllmred hat ai inference server 3.2red hat ai inference server 3.3red hat openshift ai 2.25red hat openshift ai 3.3red hat ai inference server

Updated Nov 10, 2026View on NVD →

S4E scanner

criticalProduct Based Web Vulnerabilities~10 seconds

vLLM 0.8.3 - 0.14.0 - Information Disclosure

vLLM 0.8.3 to - 0.14.1 contains an information disclosure caused by leaking a heap address in error messages from the multimodal endpoint when processing invalid images, letting remote attackers reduce ASLR entropy, exploit requires sending invalid images. References: https://github.com/vllm-project/vllm/security/advisories/GHSA-4r2x-xpjr-7cvv https://orca.security/resources/blog/cve-2026-22778-vllm-rce-vulnerability/ https://nvd.nist.gov/vuln/detail/CVE-2026-22778 Remediation: Upgrade to version 0.14.1 or later.

Used 20 times · 10 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: vllm

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →