Advisory details:
vulnrichment / CVE-2026-22778
| Advisory ID | vulnrichment/CVE-2026-22778 |
| Aliases | |
| Summary | vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an error. vLLM returns this error to the client, leaking a heap address. With this leak, we reduce ASLR from 4 billion guesses to ~8 guesses. This vulnerability can be chained a heap overflow with JPEG2000 decoder in OpenCV/FFmpeg to achieve remote code execution. This vulnerability is fixed in 0.14.1. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 9.8 | |
| ssvc | Track |
| Data source | Metasploit |
|---|---|
| Description | This module detects vLLM OpenAI-compatible servers affected by CVE-2026-22778. When an invalid image is sent to a multimodal endpoint, Pillow (PIL) raises UnidentifiedImageError whose message includes the Python repr of the underlying BytesIO buffer ("<_io.BytesIO object at 0x...>"), exposing a live heap address. Vulnerable versions return that error message directly to the client, which weakens ASLR and forms the first stage of a chain that ends in a JPEG2000 heap overflow in the bundled FFmpeg/OpenCV video decoder. Affected versions are 0.8.3 through 0.14.0 (fixed in 0.14.1, which sanitizes the address out of the message). The module first reads the unauthenticated /version banner and compares it against the affected range. It then issues a single benign request to the chat completions endpoint containing a deliberately malformed base64 image. If the response leaks a "0x" heap address the target is reported vulnerable with high confidence; if the address is stripped the fix is present; if the server reports that the model has no image support the leak path is not reachable as deployed. The probe never sends a video URL and never reaches the heap-overflow code path. |
| Note | Stability: - crash-safe Reliability: [] SideEffects: - ioc-in-logs |
| Ransomware campaign use | Unknown |
| Source publication date | Feb. 2, 2026 |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/scanner/http/vllm_multimodal_info_leak.rb |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2026-02-03T15:40:34Z/
Decision: Track
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/22xxx/CVE-2026-22778.json
Source Advisory: vulnrichment/CVE-2026-22778
[{'Exploitation': 'none'},
{'Automatable': 'yes'},
{'Technical Impact': 'total'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]