CVE-2026-115915

The vLLM inference and serving engine (prior to version 0.32.0 ) is vulnerable to a security flaw where the ImageMediaIO component passes attacker-controlled image bytes to Pillow via Image.open(BytesIO(data)). Because the application fails to restrict decoder selection and the MIME label does no...