CVE-2026-22778criticalCode execution2026-02-02
CVE-2026-22778: vLLM has RCE In Video Processing
vLLM has RCE In Video Processing.
What it is
A chain of vulnerabilities in vLLM allow Remote Code Execution (RCE):
A chain of vulnerabilities in vLLM allow Remote Code Execution (RCE):
Info Leak - PIL error messages expose memory addresses, bypassing ASLR 2. Heap Overflow - JPEG2000 decoder in OpenCV/FFmpeg has a heap overflow that lets us hijack code execution
Result: Send a malicious video URL to vLLM Completions or Invocations for a video model - Execute arbitrary commands on the server
How to check
- Affected: vllm (pip) >= 0.8.3, < 0.14.1.
- Compare your installed version with the range above (command below).
How to fix
- Upgrade vllm to 0.14.1 or later.
pip show vllm | grep VersionSources
More advisories for this tool