Description
vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an error. vLLM returns this error to the client, leaking a heap address. With this leak, we reduce ASLR from 4 billion guesses to ~8 guesses. This vulnerability can be chained a heap overflow with JPEG2000 decoder in OpenCV/FFmpeg to achieve remote code execution. This vulnerability is fixed in 0.14.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| vllm-project | vllm | >= 0.8.3, < 0.14.1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
vLLM Multimodal Heap-Address Information Leak Scanner
auxiliary/scanner/http/vllm_multimodal_info_leak
GitHub 1 repository
-
joaovicdev/EXPLOIT-CVE-2026-22778 ★ 0 · Sep 5, 2026
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- vLLM 0.8.3 - 0.14.0 - Information Disclosure http/cves/2026/CVE-2026-22778.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | vllm | >= 0.8.3, < 0.14.1 | 0.14.1 | GHSA-4r2x-xpjr-7cvv |
Advisories 1
- WID-SEC-2026-0287 vllm: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Jun 25, 2026