Input validation error in vLLM - #VU139880
Published: July 28, 2026
Vulnerability identifier: #VU139880
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to alter downstream model reasoning.
The vulnerability exists due to improper input validation in the image mode conversion logic in vllm/multimodal/image.py when parsing PNG images with tRNS transparency in non-RGBA modes. A remote attacker can supply a specially crafted image to alter downstream model reasoning.
Only the RGBA-to-RGB path is explicitly flattened; PNG images in P, L, or RGB modes with tRNS transparency fall back to direct RGB conversion, which can make subtle overlay elements visible.
Affected software
vLLM
Remediation
Install security update from vendor's website.
vLLM - update to 0.24.0