vLLM untrusted EPS image to Ghostscript execution (CVE-2026-115915)
vLLM's image loader let a crafted EPS payload labelled as PNG reach the host Ghostscript, enabling command execution where Ghostscript carried a known flaw, plus a Pillow parser-loop denial of service
categoryAI/ML and emerging attacksseverityHighlabnot yet measured
Example: vllm (pip) before 0.32.0, CVSS 8.1; chain depends on Ghostscript CVE-2024-29510; Pillow 12.0.0-12.2.0 EPS loop DoS (CVE-2026-59203)
Classification
37 values: 37 machine-classified. What do these mean?
Exploitability
| Attack vector | Software vulnerabilitiesAI model manipulation |
|---|---|
| Reach (CVSS) | Network |
| Attack complexity | High |
| Attack requirements | Present |
| Privileges required | Low |
| User interaction | None |
| Attacker skill required | Medium |
| Resources required | Low |
| Network required | Yes |
| Likelihood / prevalence | Low |
| Maturity | Emerging |
Impact & scope
| Severity | High |
|---|---|
| Impact | ConfidentialityIntegrityAvailability |
| Platform | AI SystemLinux |
| Environment | On-premisesCloudAI system |
| Target asset class | ML model / agentServer |
| Kill-chain phase (tactic) | Initial AccessExecutionImpact |
| Remote support | Yes |
Detection & telemetry
| Noise level | Medium |
|---|---|
| Data sources (ATT&CK data components) | Process CreationApplication Log ContentNetwork Traffic Content |
| Log sources | ai:model-servingapplication:logsauditd:EXECVEedr:telemetry |
| Defense bypassed | Static file analysis |
| Attack permissions (ATT&CK) | User |
Detection & response
Mitigated by 2
Framework references
- Primary source: https://github.com/advisories/GHSA-h3rc-j82p-2c3h
- cve: CVE-2026-115915 (primary)
- cwe: CWE-20
- cwe: CWE-183
- attack: T1190
Evidence & sources
- ev-0001 (vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE (GHSA-h3rc-j82p-2c3h)) — ImageMediaIO passed untrusted bytes to Pillow format autodetection without an allowlist, so a crafted EPS labelled image/png could reach the host Ghostscript; execution relies on an existing Ghostscript flaw (CVE-2024-29510), not a new one
- ev-0002 (vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE (GHSA-h3rc-j82p-2c3h)) — Affected: vllm < 0.32.0; patched 0.32.0; CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1); CWE-20, CWE-183