{"id":"CVE-2026-115915","revision":"cf3589f42f514867b975dd559fcd0999","records":[{"revision":"cf3589f42f514867b975dd559fcd0999","observedAt":"2026-10-26T18:35:30.824+00:00","statement":{"source":"cve-program","id":"CVE-2026-115915","aliases":[],"title":"vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE","description":"vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request paths through parse_image() and fetch_image() can therefore dispatch an EPS payload to host components. A host with Ghostscript affected by CVE-2024-29510 can execute commands with the vLLM process's privileges, while environments using Pillow 12.0.0 through 12.2.0 can trigger CVE-2026-59203 and exhaust media-loading workers. Deployments without the applicable vulnerable dependency are not affected by that corresponding impact. This issue is fixed in version 0.32.0.","state":0,"publishedAt":"2026-10-26T17:16:06.387+00:00","modifiedAt":"2026-10-26T17:16:57.526+00:00","affected":[{"ecosystem":"Vendor product","name":"vllm","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"vllm-project\",\n                    \"product\": \"vllm\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.32.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1,"severity":"HIGH"}],"references":["https://github.com/vllm-project/vllm/security/advisories/GHSA-h3rc-j82p-2c3h","https://github.com/vllm-project/vllm/pull/60022","https://github.com/vllm-project/vllm/commit/710ac56e691d4713feca50a43e6c440f07d373fd","https://github.com/vllm-project/vllm/releases/tag/v0.32.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115915","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-115915","identifiers":["CVE-2026-115915"]},"retained":false,"historicalAffected":[]}],"coverage":[]}