CVE-2026-115915: CVE-2026-115915: vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageM…
vllm · vllm · NVD published 2026-10-26 · posted 2026-11-04 · last modified 2026-10-28
CVE-2026-115915 at a glance
CVE-2026-115915 is a critical-severity vulnerability in Vllm, with a CVSS 3.1 base score of 9.8. NVD published it on 2026-10-26 and classifies the weakness as CWE-20 and CWE-183. FIRST EPSS puts the probability of exploitation activity in the next 30 days at 0.66% (percentile 51.6, scored 2026-11-03). NVD configuration data lists a fixed release for 1 product, for example vllm vllm 0.32.0. CVERadar maps 1 MITRE ATT&CK technique across Initial Access, inferred from the CWE and the description. Its CVERadar threat level is 49/100.
What it is
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request paths through parse_image() and fetch_image() can therefore dispatch an EPS payload to host components. A host with Ghostscript affected by CVE-2024-29510 can execute commands with the vLLM process's privileges, while environments using Pillow 12.0.0 through 12.2.0 can trigger CVE-2026-59203 and exhaust media-loading workers. Deployments without the applicable vulnerable dependency are not affected by that corresponding impact. This issue is fixed in version 0.32.0.
| Weakness | CWE-20 definition, CWE-183 definition |
|---|---|
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (source: NIST NVD) |
| ATT&CK tactics | Initial Access |
Defend the Chain
The attack chain for CVE-2026-115915 laid across the MITRE ATT&CK Enterprise tactics. Solid cards come from the MITRE CTID KEV mappings; dashed cards are inferred by CVERadar from the CWE or description. Correct defences are real ATT&CK mitigations for that technique.
Pick a red technique card on the board, then choose the defence that stops it.
Defend against T1190 Exploit Public-Facing Application Inferred
Inferred from CWE CWE-20
Patches, mitigations and detection
Fixed versions
- vllm vllm: upgrade to 0.32.0 or later (affected from 0.30.0)
Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.
Vendor advisories and patches
- GitHub patch (github.com) (Patch)
- GitHub patch (github.com) (Patch)
- GitHub release notes (github.com) (Release Notes)
- GitHub vendor advisory (github.com) (Patch, Vendor Advisory)
MITRE ATT&CK mitigations for this chain
- M1048 Application Isolation and Sandboxing (for T1190) : Application isolation will limit what other processes and system features the exploited target can access.
- M1037 Filter Network Traffic (for T1190) : Restrict outbound network traffic from public-facing servers to prevent unauthorized connections from initiating communications with attacker-controlled infrastructure. While this may not prevent the initial exploitation, it limits the attacker's ability to verify and control the compromised server post-exploit, reduci
- M1030 Network Segmentation (for T1190) : Segment externally facing servers and services from the rest of the network with a DMZ or on separate hosting infrastructure.
- M1016 Vulnerability Scanning (for T1190) : Regularly scan externally facing systems for vulnerabilities and establish procedures to rapidly patch systems when critical vulnerabilities are discovered through scanning and through public disclosure.
- M1026 Privileged Account Management (for T1190) : Use least privilege for service accounts will limit what permissions the exploited process gets on the rest of the system.
- M1050 Exploit Protection (for T1190) : Web Application Firewalls may be used to limit exposure of applications to prevent exploit traffic from reaching the application.
- M1035 Limit Access to Resource Over Network (for T1190) : Ensure that all publicly exposed services are actually intended to be so, and restrict access to any that should only be available internally.
- M1051 Update Software (for T1190) : Update software regularly by employing patch management for externally exposed applications.
Detection Generic guidance
- Initial Access: Alert on unusual requests to the affected service (odd paths, oversized payloads, exploit strings) in WAF, reverse-proxy and application logs.
Response checklist Generic guidance
- Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
- Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
- Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
- Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.