# CVE-2026-12491: vLLM improper image metadata handling in image processing

Source: https://junglewise.ai/threats/cve-2026-12491-vllm-improper-image-metadata-handling-in-image-processing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2026-12491 · Severity: medium · CVSS 4.8 · Published 2026-06-17

vLLM is an open-source library used for running large language models, including those that process images. A flaw in how it handles image metadata means that certain images (like those with specific rotation settings or transparency) may be misinterpreted by the AI. This could lead to the model making incorrect decisions or misidentifying content, potentially compromising the reliability of automated systems using this library.

Technologies: [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm), [Red Hat AI Inference Server](https://junglewise.ai/threats/technologies/ai-inference-server). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-12491 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12491 being exploited in the wild.

**How severe is CVE-2026-12491?** Medium severity, with a CVSS score of 4.8, published 17 June 2026.

**Which products and versions are affected?** vllm (PyPI) ECOSYSTEM:introduced=0.11.0,fixed=0.24.0, ECOSYSTEM:introduced=0.11.0,last_affected=0.23.0; Red Hat AI Inference Server 3.

**Is there a fix for CVE-2026-12491?** Yes. vllm (PyPI): upgrade to 0.24.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12491 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-12491?** Check whether you run vllm (PyPI) or Red Hat AI Inference Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- vllm (PyPI): upgrade to 0.24.0 or later

  ```sh
  pip install "vllm>=0.24.0"
  ```


## Technical details

A vulnerability exists in vLLM's image processing pipeline due to the lack of normalization for EXIF orientation and improper handling of PNG tRNS transparency data. Specifically, the library fails to call ImageOps.exif_transpose after opening an image, causing a mismatch between human-perceived orientation and model input. Additionally, while RGBA-to-RGB conversion is handled, PNGs using tRNS in other modes (P/L/RGB) are converted to RGB via a path that discards or remaps transparency semantics. An attacker could provide specially crafted images to cause the model to misinterpret input content. This issue is similar to the 'AlphaDog' class of attacks where subtle overlay elements become visible or distort the input after incorrect flattening.

## Affected products

- vLLM Project vLLM
- Red Hat Red Hat AI Inference Server 3

## Identifiers

- CVE-2026-12491
- GHSA-8jr5-v98p-w75m
- PYSEC-2026-3406

## Timeline

- 2026-06-17: disclosed: Initial report via Red Hat and NVD

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-12491](https://access.redhat.com/security/cve/CVE-2026-12491)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2489786](https://bugzilla.redhat.com/show_bug.cgi?id=2489786)

## Related threats

- [vLLM chat template resource exhaustion DoS](https://junglewise.ai/threats/cve-2026-115918-vllm-is-an-inference-and-serving-engine-for-large-language)
- [vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server](https://junglewise.ai/threats/cve-2026-115917-vllm-is-an-inference-and-serving-engine-for-large-language)
- [vLLM off-by-one error in tokenizer max_token_id validation](https://junglewise.ai/threats/cve-2026-115916-vllm-is-an-inference-and-serving-engine-for-large-language)
- [vLLM image format validation bypass in media processing](https://junglewise.ai/threats/cve-2026-115915-vllm-is-an-inference-and-serving-engine-for-large-language)
- [vLLM denial of service in DeepSeek-OCR image processing](https://junglewise.ai/threats/cve-2026-115914-vllm-is-an-inference-and-serving-engine-for-large-language)