CVE-2026-115915 is a format-confusion bug in vLLM's image-upload handling that lets an attacker disguise a PostScript (EPS) file as a different image type and have it reach Pillow's EPS decoder, which in turn invokes the host's Ghostscript binary; on hosts where Ghostscript is still vulnerable to the older CVE-2024-29510, this chain results in remote code execution with the privileges of the vLLM process, while on hosts running the unpatched Pillow 12.0.0-12.2.0 range it can instead exhaust vLLM's media-loading worker pool as a denial of service.
Vulnerability summary
9.8
Critical
0.7%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-26
Published
Vulnerability ID: CVE-2026-115915 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| vLLM | cpe:2.3:a:vllm:vllm:*:*:*:*:*:*:*:* | Before 0.32.0 (confirmed affected: 0.30.0); fixed in 0.32.0 |
What this means
CVE-2026-115915 affects ImageMediaIO in vLLM, the widely used open-source inference and serving engine for large language models. When an image-capable request path (reached through parse_image() / fetch_image()) receives attacker-supplied bytes, vLLM passes them to Pillow via Image.open(BytesIO(data)) without restricting which decoder Pillow is allowed to use, and the request's declared MIME type does not constrain that choice. An attacker can therefore label a PostScript (EPS) payload as an unrelated image format and have Pillow's EPS codec process it, which shells out to the system's Ghostscript binary to rasterize the file (vLLM GHSA-h3rc-j82p-2c3h).
The practical impact depends on what else is installed on the host: if Ghostscript is present and still vulnerable to the earlier CVE-2024-29510 (a %pipe%-style command-injection flaw patched in Ghostscript 10.03.1), the EPS payload can execute arbitrary commands as the vLLM process user; if Ghostscript is absent or already patched, that specific chain does not fire. Separately, deployments running vLLM 0.30.0 with Pillow in the 12.0.0-12.2.0 range can trigger CVE-2026-59203 through the same code path, exhausting vLLM's media-loading worker pool as a denial of service rather than achieving code execution. The vendor's advisory is explicit that "deployments without the applicable vulnerable dependency are not affected by that corresponding impact" (NVD; vLLM GHSA-h3rc-j82p-2c3h).
NVD performed its own analysis and assigned a CVSS v3.1 Primary score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting the worst-case remote-code-execution outcome of the chain; GitHub's own Secondary score is lower at 8.1, assuming higher attack complexity (NVD).
vLLM's GitHub security advisory confirms version 0.30.0 is affected and the fix ships in 0.32.0, which restricts the decoders ImageMediaIO will accept; it does not describe an in-product workaround, so operators who cannot upgrade immediately should instead remove or patch Ghostscript (to 10.03.1 or later) on hosts that run vLLM with image inputs enabled (vLLM GHSA-h3rc-j82p-2c3h).
As of 2026-10-30, FIRST scores the probability of exploitation at 0.0066 (51.5th percentile) — a multi-step, dependency-conditional chain rather than a universally exploitable bug, but still higher than most freshly disclosed CVEs given vLLM's wide deployment in AI-inference infrastructure (FIRST EPSS). It is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Teams running vLLM with user-supplied image inputs should upgrade to 0.32.0 and verify Ghostscript and Pillow versions on the same host regardless.
Evidence
- ImageMediaIO passes attacker-controlled bytes to Pillow without restricting decoder selection or honoring the declared MIME type, letting a mislabeled EPS payload reach Pillow's EPS decoder which shells out to Ghostscript. — vLLM GHSA-h3rc-j82p-2c3h
- On a host with Ghostscript vulnerable to CVE-2024-29510, the chain achieves command execution as the vLLM process user; on vLLM 0.30.0 with Pillow 12.0.0-12.2.0, the same path instead triggers CVE-2026-59203, a worker-exhaustion DoS; deployments without the applicable dependency are unaffected by that specific impact. — NVD
- NVD Primary CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; GitHub's own Secondary score is 8.1. — NVD
- Affected in vLLM 0.30.0, fixed in 0.32.0; no in-product workaround described beyond upgrading or remediating Ghostscript. — vLLM GHSA-h3rc-j82p-2c3h
- EPSS score is 0.0066 (51.5th percentile) as of 2026-10-30; not listed in CISA KEV. — FIRST EPSS
