vLLM is an inference engine that processes image inputs through Pillow. Before version 0.32.0 it passes raw image bytes to Pillow without selecting a decoder, allowing an attacker-controlled EPS image to be interpreted in any format. Because the MIME label does not restrict the format, the image-capable request paths parse_image() and fetch_image() can dispatch the payload, potentially triggering a denial of service or remote code execution.

This vulnerability impacts installations of the vllm project running vLLM prior to 0.32.0. It can be exploited when the host runs a Ghostscript version that is vulnerable to CVE-2024-29510, or when Pillow 12.0.0 through 12.2.0 is used, which can lead to media-loading worker exhaustion. Environments that do not include these vulnerable dependencies are not affected.

The flaw carries a CVSS score of 8.1, indicating a high-severity vulnerability. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. A remote attacker who can send image data to an exposed vLLM inference endpoint can trigger the effect. If the host’s Ghostscript is vulnerable, the attacker can obtain execution privileges of the vLLM process; otherwise, the attacker may achieve a denial of service by exhausting media-loading workers. The attack vector is inferred to be remote, as the description indicates that exploitation occurs via API calls that accept image payloads from external sources.