Executive Summary
A critical vulnerability, CVE-2026-22778 (CVSS 9.8), has been identified in the vLLM inference framework affecting versions 0.8.3 through 0.14.0. The flaw resides in the multimodal processing path, where the application incorrectly handles malformed video input. Attackers can exploit this by submitting a malicious video URL to the `/v1/chat/completions` or `/v1/invocations` endpoints, potentially gaining full remote code execution (RCE) on the server.
The attack involves a two-stage chain: first, a verbose error from the Pillow (PIL) library leaks a process heap address, allowing an attacker to bypass Address Space Layout Randomization (ASLR). Second, a heap-based buffer overflow is triggered in the underlying JPEG2000 decoder (libopenjp2) via OpenCV and FFmpeg when processing a malicious 'cdef' box. This allows the attacker to overwrite function pointers and hijack the control flow of the serving process.
This vulnerability is particularly high-risk as it can be triggered pre-authentication in certain configurations and affects any vLLM deployment serving a video-capable model. Organizations using vLLM for multimodal AI tasks should prioritize upgrading to version 0.14.1 immediately.