Threats tagged 'pysec-2026-4346'

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
High	8.1	EPSS 0.7%	CVE-2026-115915Vllm: Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) High8.1EPSS 0.7%2026-10-26GCVE DatabaseCVE-2026-115915 vLLM versions prior to 0.32.0 contain a critical vulnerability where attacker-controlled image bytes are passed to Pillow's Image.open without restricting decoder selection. This allows dispatching of malicious EPS payloads that can lead to command execution if the host has a vulnerable Ghostscript (CVE-2024-29510) or denial of service via Pillow vulnerabilities (CVE-2026-59203). The issue is fixed in version 0.32.0. EPSS 0.7%Report on CVE-2026-115915 Vulnerability #pysec-2026-4346 #pypi	GCVE Database	2026-10-26

Page 1 of 1