A remote user who can access the OpenAI-compatible API can submit a specially crafted image whose normalized pixel values sum to zero. In vLLM versions 0.11.1 through 0.32.0, the image path handling for DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR does not produce an embedding for such an image, causing a chain of calls that eventually triggers a fatal assertion in sanity_check_mm_encoder_outputs. The assertion aborts the entire engine, resulting in a denial of service for all clients with no authentication or privilege escalation required.

Vulnerable editions of the vLLM inference engine, specifically versions 0.11.1 up to, but not including, 0.32.0, expose the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image endpoints. Any deployment that allows external clients to invoke the OpenAI‑compatible API and transmit image data is at risk. The fix was released in v0.32.0.

The CVSS score of 6.5 classifies the flaw as moderate severity, while the EPSS score is not provided and the vulnerability is not listed in the CISA KEV catalog. The lack of authentication or privilege checks means the attack can be conducted by any remote party that can reach the API, making the exploit likelihood higher than for more restricted flaws. The denial of service affects all users of the engine, and the attack does not compromise confidentiality or integrity beyond service interruption.