# vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE

vLLM's ImageMediaIO fed attacker image bytes to Pillow autodetection without a format allowlist, letting an EPS labeled image/png reach host Ghostscript and execute commands via CVE-2024-29510.

- Payout: Research
- Severity: high
- Program: vLLM
- Found by: LittlehamsterXu
- Disclosed: 2026-10-28
- CVE: CVE-2026-115915
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-h3rc-j82p-2c3h
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-h3rc-j82p-2c3h
- Tags: area:ai domain:ai domain:web impact:dos impact:rce kind:research platform:ghsa sev:high tech:python technique:chained technique:source-review vuln:dos vuln:file-upload vuln:rce

**Target:** ImageMediaIO / multimodal image loader (Pillow EPS -> Ghostscript)
**Root cause:** ImageMediaIO calls Image.open(BytesIO(data)) without a Pillow format allowlist, so the declared MIME type does not constrain decoder selection and EPS bytes are dispatched to Ghostscript.
**Steps:**
1. Send image bytes labeled `image/png` whose content is an EPS file (Pillow detects EPS by file signature).
2. Reach an image-capable request path (OpenAI chat multimodal parse_image/fetch_image or data URL media connector) that forwards bytes to ImageMediaIO.load_base64().
3. Loader calls `Image.open(BytesIO(data))` then `image.load()`, entering Pillow's EPS plugin which invokes Ghostscript with `-dSAFER -sDEVICE=pnmraw` and the untrusted EPS.
4. Craft EPS exploiting CVE-2024-29510 to bypass -dSAFER and run a command (repro used `touch` on a temp marker) as the vLLM process user.
**How found:** Noticed ImageMediaIO is the boundary where untrusted bytes enter Pillow autodetection and that the MIME label doesn't constrain decoder selection; traced the OpenAI multimodal parser and media connector to the loader, then tested an EPS payload through the actual wheel with a vulnerable Debian Ghostscript build.
**Exploitation:** Attacker with access to an image-processing endpoint supplies EPS bytes mislabeled as image/png; Pillow's EPS plugin spawns host Ghostscript, and a CVE-2024-29510 payload escapes -dSAFER to execute commands with vLLM process privileges. Requires vulnerable host Ghostscript build; loader-level execution reproduced, HTTP path source-traced only.
**Escalation:** N-day chain: vLLM's permissive format dispatch reaches a host Ghostscript vulnerable to CVE-2024-29510, converting an image upload into host command execution.
**Insight:** When a service accepts user images, check whether it enforces a Pillow format allowlist: a MIME label is not a decoder constraint, and EPS/PS signatures route bytes to host Ghostscript, so any host Ghostscript N-day becomes reachable RCE.