The vulnerability occurs when vLLM receives an invalid image through its multimodal endpoint; the underlying PIL library throws an error containing a heap address that is returned to the client. This exposure drastically weakens ASLR from billions of possibilities to approximately eight, constituting an information disclosure (CWE‑209). When chained with a JPEG2000 decoder in OpenCV/FFmpeg, the leaked address allows an attacker to trigger a heap overflow, resulting in remote code execution (CWE‑532).

Affected versions of the vllm engine include all releases from 0.8.3 up to and including 0.14.0. The vllm-project’s official fix is incorporated in release 0.14.1 and applies to all later releases.

The CVSS v3.1 base score of 9.8 indicates a critical vulnerability, but the EPSS score of less than 1% suggests that exploitation is unlikely in the wild at present. The attack vector requires an attacker to send a crafted image to the multimodal endpoint, causing the PIL error and leaking the address. With the address known, the attacker can exploit the referenced JPEG2000 heap overflow to achieve remote code execution. The vulnerability is not listed in the CISA KEV catalog, yet its severity warrants immediate remediation.