CVE-2026-115914

MEDIUM Status: Awaiting Analysis

CVSS Scores

CVSS v3.x Base Score
6.5
MEDIUM

Description

vLLM is an inference and serving engine for large language models. From 0.11.1 until 0.32.0, the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image path allows a remote client that can reach the OpenAI-compatible API to submit a legal image whose normalized pixels sum to zero when that image is alone in its per-step encoder batch. _parse_and_validate_image_input returns no embedding, embed_multimodal propagates that value, and sanity_check_mm_encoder_outputs triggers a fatal assertion that shuts down the engine for all users. This issue is fixed in version 0.32.0.

Published
October 26, 2026 6:17 PM
Last Modified
October 26, 2026 6:34 PM
Source
[email protected]

Weaknesses (CWE)

CWE-617

References

Contact Us

Get the CyboWatch SIEM platform, hosting, and 24×7 SOC analysts. Send an enquiry, or call or email us to get started.

Send an enquiry