The flaw in vLLM allows an authenticated caller to forge shared‑memory handle and monotonic_id values in the public multimodal features.kwargs_data field. When scale‑out deployments enable shared‑memory multimodal caching, the worker trusts these values and forwards the attacker‑chosen byte stream to Python's pickle.loads, even when insecure serialization is disabled. This results in arbitrary Python code execution, which can compromise the host or any other users sharing the same worker process.

All installations of the vLLM inference and serving engine prior to version 0.32.0 are affected. The vulnerability applies to the vllm-project:vllm product when deployed in scale‑out mode with shared‑memory multimodal caching activated. Proper upgrades beyond 0.32.0 mitigate the risk.

The CVSS score of 7.5 indicates a high‑severity risk. Although the EPSS score is not available and the issue is not listed in CISA KEV, the attack requires an authenticated victim in a scale‑out configuration. Once authenticated, the attacker can craft malicious data that is deserialized by worker processes, enabling full code execution on the host. The vulnerability is exploitable in practice in environments where shared‑memory multimodal caching is enabled and the insecure serialization option is disabled, making it a realistic threat vector for administrators who manage vLLM services.