NVD CRITICAL: CVE-2026-115915 — vLLM is an inference and serving engine for large language models. Prior to 0.32...
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request paths through parse_image() and fetch_image() can therefore dispatch an EPS payload to host componen
CVE-2026-115915