GitHub Security Advisory: GHSA-4r2x-xpjr-7cvv
Package: vllm (PIP)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-122: Heap-based Buffer Overflow, CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: >= 0.8.3, < 0.14.1
Patched in: 0.14.1

Summary: vLLM has RCE In Video Processing

Details:
## Summary

**A chain of vulnerabilities in vLLM allow Remote Code Execution (RCE):**

1. **Info Leak** - PIL error messages expose memory addresses, bypassing ASLR
2. **Heap Overflow** - JPEG2000 decoder in OpenCV/FFmpeg has a heap overflow that lets us hijack code execution

**Result:** Send a malicious video URL to vLLM Completions or Invocations **for a video model** -> Execute arbitrary commands on the server

Completely default vLLM instance directly from pip, or docker, does not have authentication so "None" privileges are required, but even with non-default api-key enabled configuration this exploit is feasible through invocations route that allows payload to execute pre-auth. 

Example heap target is provided, other heap targets can be exploited as well to achieve rce. Leak allows for simple ASLR bypass. Leak + heap overflow achieves RCE on versions prior to 0.14.1. 

Deployments not serving a video model are not affected.

---


## 1. Vulnerability Overview

### 1.1 The Bug: JPEG2000 cdef Box Heap Overflow
The JPEG2000 decoder used by OpenCV (cv2) honors a `cdef` box that can remap color channels. When Y (luma) is mapped into the U (chroma) plane buffer, the decoder writes a large Y plane into the smaller U buffer, causing a heap overflow.

**Root Cause**
- `cdef` allows channel remapping (e.g., Y→U, U→Y).
- Y plane size: `W×H`; U plane size: `(W/2)×(H/2)`.
- Overflow size = `W×H - (W/2×H/2)` = `0.75 × W × H` bytes.

**Example (150×64)**
- Y plane: 150×64 = 9,600 bytes  
- U plane: 75×32 = 2,400 bytes  
- Overflow: 7,200 bytes past the U buffer

### 1.2 Malicious cdef Box
```
Offset  Size  Field           Value
0       4     Box Length      0x00000016 (22 bytes)
4       4     Box Type        'cdef'
8       2     N (channels)    0x0003
10      2     Channel 0 Cn    0x0000 (Y channel)
12      2     Channel 0 Typ   0x0000 (color)
14      2     Channel 0 Asoc  0x0002 (→ maps Y into U plane)
16      2     Channel 1 Cn    0x0001 (U channel)
18      2     Channel 1 Typ   0x0000 (color)
20      2     Channel 1 Asoc  0x0001 (→ maps U into Y plane)
22      2     Channel 2 Cn    0x0002 (V channel)
24      2     Channel 2 Typ   0x0000 (color)
26      2     Channel 2 Asoc  0x0003 (→ maps V plane)
```
Key control: `Asoc=2` for channel 0 forces Y data into the U buffer, triggering the overflow.

---

## Vulnerable Code Chain

### 1) Entry: vLLM accepts a remote `video_url` and downloads raw bytes

vLLM’s OpenAI-compatible API supports a `video_url` content part:

```python
class VideoURL(TypedDict, total=False):
    url: Required[str]

class ChatCompletionContentPartVideoParam(TypedDict, total=False):
    video_url: Required[VideoURL]
    type: Required[Literal["video_url"]]
```

Source: `src/vllm/entrypoints/chat_utils.py`.

When the URL is HTTP(S), vLLM downloads it as **raw bytes** and passes the bytes into the modality loader:

```python
if url_spec.scheme.startswith("http"):
    data = connection.get_bytes(url, timeout=fetch_timeout, allow_redire