This vulnerability in the vLLM open-source library used by Red Hat AI Inference Server arises from incorrect processing of image metadata, including EXIF orientation and PNG transparency information. When images are converted to RGB format, transparency data may be discarded or remapped incorrectly, causing unexpected rendering of transparent pixels and distortion of the input image. This can affect the integrity of the data processed by the AI model, potentially leading to incorrect inference results. The CVSS 3.1 base score is 4.8 (medium severity), with network attack vector, high attack complexity, no privileges required, no user interaction, and limited impact on integrity and availability. There is no vendor advisory indication of an available patch or remediation level at this time.

The vulnerability may cause the AI inference model to misinterpret image content due to distorted or incorrectly rendered transparent pixels. This impacts the integrity of the processed data. There is no confidentiality impact reported, and availability impact is limited. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-12491 for current remediation guidance. No official fix or workaround is indicated in the advisory content provided. Users should monitor the vendor advisory for updates and apply any official patches once available.