Executive brief
vLLM, a popular library for serving artificial intelligence models, is vulnerable to a critical security flaw when processing video content. An attacker can send a specially crafted video URL to the server, which allows them to take complete control of the system and execute unauthorized commands. This could lead to the theft of sensitive AI models, customer data, or a total service outage.
Technical details
A remote code execution (RCE) vulnerability exists in vLLM due to a chain of two flaws. First, an information leak in PIL error messages exposes heap memory addresses, allowing attackers to bypass Address Space Layout Randomization (ASLR). Second, a heap buffer overflow exists in the JPEG2000 decoder (libopenjp2) within the FFmpeg 5.1.x bundle used by OpenCV (cv2), which vLLM utilizes for video decoding. By providing a malicious video URL containing a JPEG2000 'cdef' box that remaps color channels (e.g., Y to U), an attacker can trigger an overflow to overwrite function pointers (such as AVBuffer.free) with system calls. This exploit can be triggered via the /v1/chat/completions or /v1/invocations endpoints on deployments serving video models. The issue is resolved in vLLM version 0.14.1.
Affected products
- vLLM Project vLLM >= 0.8.3, < 0.14.1
- OpenCV OpenCV (cv2) with FFmpeg bundle 4.x
Timeline
- 2026-02-02: advisory: GHSA-4r2x-xpjr-7cvv published
- 2026-02-02: patched: vLLM version 0.14.1 released