Input validation error in vLLM - #VU139879
Published: July 28, 2026
Vulnerability identifier: #VU139879
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to alter downstream model reasoning.
The vulnerability exists due to improper input validation in the image processing logic in vllm/multimodal/image.py when parsing images with EXIF orientation metadata. A remote attacker can supply a specially crafted image to alter downstream model reasoning.
The issue arises because EXIF orientation is not normalized before the image is processed by the model.
Affected software
vLLM
Remediation
Install security update from vendor's website.
vLLM - update to 0.24.0