A high-severity advisory published on October 28 discloses that vLLM's image-loading path can be weaponized to execute arbitrary commands on hosts running a vulnerable Ghostscript build1. The flaw, tracked as CVE-2026-115915 and GHSA-h3rc-j82p-2c3h, affects all vLLM pip versions below 0.32.0; version 0.32.0 is the patched release.
Format dispatch without guardrails
The root cause sits in vLLM's `ImageMediaIO`, which hands attacker-controlled image bytes directly to Pillow's format autodetection without restricting accepted formats. The declared MIME type on the inbound request does not constrain which decoder Pillow selects, so an EPS payload labeled `image/png` can reach the host's Ghostscript executable. On a host running Ghostscript affected by CVE-2024-29510, the known Ghostscript sandbox escape is then reachable through vLLM's image-loading path, enabling command execution with the vLLM process's privileges.
The advisory's author reproduced loader-level execution using the PyPI wheel's `ImageMediaIO.load_base64()` implementation with vLLM 0.30.0, Pillow 12.3.0, and Debian amd64 Ghostscript 10.03.0. An adapted EPS payload ran a `touch` command on a temporary marker file; the marker existed after the loader call, though Pillow then raised a `ValueError` because the exploit changes Ghostscript's output device. The HTTP request path was source-traced but was not exercised end to end.
A second, Pillow-only denial-of-service path
The same input boundary also exposes a separate denial-of-service condition when the installed Pillow version is between 12.0.0 and 12.2.0. A separate CVE, CVE-2026-59203, is triggered by a negative `%%BeginBinary` byte count that causes Pillow's EPS parser to loop during `Image.open()`. In an isolated local check with Pillow 12.2.0, the sample hung through `ImageMediaIO.load_bytes()` and `MediaConnector.fetch_image_async()`. Eight concurrent image loads occupied the connector's eight media-loading threads and left a benign image load queued. Pillow 12.3.0 rejected the same sample promptly. The published vLLM 0.30.0 requirements leave Pillow unpinned, so an existing environment can retain an affected Pillow version.
Scope and mitigations
Exploitation of the RCE chain requires three conditions: an image-capable request path, a caller able to reach it under the deployment's authentication policy, and a host Ghostscript build vulnerable to CVE-2024-29510. Deployments without Ghostscript or with a build fixed for CVE-2024-29510 are not affected by the execution chain. Ghostscript lists 10.03.1 as the upstream fixed version for CVE-2024-29510. The advisory states that only PyPI vLLM 0.30.0 was checked, and no wider affected release range or other Ghostscript vendor build is claimed. The patched vLLM source at the cited commit requires Pillow 12.3.0 or later.
ANALYSIS The vulnerability turns every vLLM deployment that accepts user-supplied images into a potential host-level compromise vector, contingent on the Ghostscript version present in the container or host. API-key gating and network access controls determine who can reach the request path, but they do not address the underlying format-dispatch flaw. This is the second security fix carried by vLLM 0.32.0, which also patched a Phi 4 audio encoder out-of-memory crash[1].