CVE-2026-22778: vLLM Remote Code Execution Vulnerability in Video Processing
Summary
CVE-2026-22778: vLLM has RCE In Video Processing. Affects vllm versions >= 0.8.3, < 0.14.1. Fixed in 0.14.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vLLM is an open-source library designed for efficient video processing and machine learning tasks. It leverages various multimedia frameworks, including OpenCV and FFmpeg, to handle video data. The library is widely used in applications that require video analysis and generation, making it crucial for developers to ensure its security. This vulnerability exposes vLLM to remote code execution (RCE) risks, particularly when processing video URLs.
Vulnerability Detail
The vulnerability arises from a chain of issues in vLLM that allow for remote code execution. It begins with an information leak where PIL error messages expose memory addresses, bypassing Address Space Layout Randomization (ASLR). This is followed by a heap overflow in the JPEG2000 decoder used by OpenCV and FFmpeg, which can be exploited by sending a malicious video URL to vLLM. The overflow allows attackers to overwrite function pointers, leading to arbitrary command execution on the server. This vulnerability affects all versions of vLLM from 0.8.3 to below 0.14.1 when serving a video model.
How To Fix
Latest published version: 0.32.0 as of 22 Oct 2026
pip install --upgrade "vllm==0.32.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.14.1
This is the first release that contains the fix.
pip install --upgrade "vllm==0.14.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update vLLM, consider disabling the video processing features or restricting access to the endpoints that accept video URLs until the update can be applied.
Conclusion
The CVE-2026-22778 vulnerability in vLLM poses a significant risk due to its potential for remote code execution through video processing. It is crucial for users of vLLM to update to the latest version to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for vllm →
FAQ
CVE-2026-22778 is a vulnerability in the vLLM library that allows for remote code execution through malicious video processing.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities.
Exploitation of this vulnerability can lead to arbitrary code execution on the server, potentially compromising the entire system.
Yes, the vulnerability has been patched in vLLM version 0.14.1. Updating to this version will resolve the issue.
If immediate updating is not possible, consider disabling video processing features or restricting access to the affected endpoints.
References
Related vulnerabilities
Recent vulnerabilities recorded for vllm.
