What’s Vulnerable › Vulnerabilities

CVE-2026-115912: vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-26 · updated 2026-10-28
• Weakness: CWE-502

Description

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated caller can place forged shared-memory address and monotonic_id values in public multimodal features.kwargs_data. In scale-out deployments with shared-memory multimodal caching enabled, workers trust those values and pass attacker-selected bytes to pickle.loads(), allowing arbitrary Python execution even when insecure serialization is disabled. This issue is fixed in version 0.32.0.

Affected products

• vllm-project vllm: before 0.32.0 — fixed in 0.32.0
• vllm-project vllm: before 0.32.0

How to fix

Upgrade to a fixed version: vllm-project vllm 0.32.0. Check the vendor advisory for mitigations.

References

• https://github.com/vllm-project/vllm/commit/3d5625cc3c2474994107047d7a6ecb8e4008f9b0
• https://github.com/vllm-project/vllm/pull/59357
• https://github.com/vllm-project/vllm/releases/tag/v0.32.0
• https://github.com/vllm-project/vllm/security/advisories/GHSA-6757-hggm-hp2w

Get alerted when CVE-2026-115912 or the next vulnerability affects your stack