vLLM CVE-2026-22778 exposes AI serving stacks to remote code execution

At a glance

What this is: Orca Security analyses CVE-2026-22778, a critical vLLM flaw that allows unauthenticated remote code execution through a crafted video URL.

Why it matters: It matters because AI serving platforms can expose high-value workloads, prompts, and infrastructure paths when network reachability and input handling are not tightly governed.

By the numbers:

• CVE-2026-22778 is rated critical with a CVSS score of 9.8.
• vLLM versions from 0.8.3 to before 0.14.1 are affected.

Context

CVE-2026-22778 is a remote code execution flaw in vLLM, a Python inference engine used to serve large language models at production scale. The risk is not just code execution in isolation. In an AI serving context, exposed inference endpoints can become a route into model infrastructure, prompt data, and adjacent workloads if the service is reachable without meaningful identity or network controls.

The article shows that the exploit chains an information leak with a heap overflow in video processing, which is a reminder that modern AI stacks often include multiple parsing layers before a request reaches the model. For IAM, PAM, and NHI teams, the key issue is that reachability and trust assumptions around service exposure can matter as much as patching the vulnerable component.

Key questions

Q: What breaks when AI serving endpoints can process attacker-controlled media before authentication?

A: The trust boundary breaks. Once a request can drive image or video parsing before strong access checks, the serving stack becomes vulnerable to remote code execution through its dependencies, not just its model logic. Teams should treat unauthenticated parsing paths as privileged execution surfaces and remove unnecessary media support from exposed endpoints.

Q: Why does a memory disclosure make an AI serving vulnerability much easier to exploit?

A: Because exploit reliability depends on predictability. When a parser or API error leaks heap state, attackers can defeat address randomisation and move from a probabilistic attack to a repeatable one. In serving environments, error output should be treated as sensitive data because it can directly support code execution chains.

Q: How can security teams tell whether a vLLM deployment is at higher risk than expected?

A: Look for exposed video-capable endpoints, external video_url parameters, and error logs that reveal internal memory addresses or parser failures. Those are signs that the vulnerable path is reachable and that the application is leaking the information an attacker would use to make exploitation reliable.

Q: What should teams do when a model-serving host may have been compromised?

A: Isolate the host, preserve logs and memory evidence, and review adjacent systems for lateral movement before restoring service. Then rotate any credentials or API keys that may have been available to the compromised process and examine prompt or model data for possible exposure.

Technical breakdown

How the information leak weakens exploit reliability

The first stage uses an error-handling flaw in the image-processing path. When a malformed image triggers a Python Imaging Library exception, vLLM returns an error message that exposes a heap address from a BytesIO object. That matters because Address Space Layout Randomization depends on attackers not knowing where useful memory objects live. Once an address is disclosed, exploitation becomes far more deterministic. In practice, the weakness is not just that an exception is visible. It is that sensitive runtime state is being reflected back through an API path that should have been treated as untrusted input handling.

Practical implication: suppress memory-bearing error output from AI serving endpoints and treat exception leakage as an exploitable exposure condition.

Why the JPEG2000 decoder becomes an execution primitive

The second stage is a heap-based buffer overflow in the JPEG2000 decoder used during video processing. The crafted video manipulates channel remapping so data intended for a larger Y buffer is written into a smaller U buffer, overwriting adjacent heap memory. That kind of mismatch turns media parsing into code execution territory because the attacker is not trying to break the model. They are abusing a pre-model parsing dependency that sits inside the serving stack. AI inference platforms often inherit this risk from image and video libraries that were never designed as identity-aware trust boundaries.

Practical implication: treat multimedia parsing dependencies as part of the attack surface, not as harmless utility code around the model.

Why unauthenticated API reachability changes the security model

The disclosure says the vulnerable path can be reached through network-accessible API routes and that authentication is not required for the initial attack attempt. That shifts the control problem from user identity alone to service exposure, request routing, and trust boundaries around machine-to-machine traffic. For AI serving, the practical question is not whether the model is authenticated after the fact. It is whether the reachable request path allows an unauthenticated actor to drive execution into sensitive parsing code before any meaningful authorization decision is enforced.

Practical implication: verify which inference endpoints are internet-reachable and whether unauthenticated request paths can still reach high-risk parsing functions.

Threat narrative

Attacker objective: The attacker wants arbitrary command execution on the vLLM server so they can pivot into AI infrastructure and access sensitive assets.

1. Entry occurs when an attacker sends a crafted request to a video-enabled vLLM endpoint using a video_url parameter that points to attacker-controlled content.
2. Credential or state hardening is undermined when an invalid image probe returns a heap address, giving the attacker the memory knowledge needed to make exploitation reliable.
3. Escalation follows when malicious JPEG2000 content triggers a heap overflow that overwrites a function pointer and redirects execution to system().
4. Impact is remote command execution on the AI serving host, with potential exposure of prompts, model data, and adjacent infrastructure paths.

Breaches seen in the wild

• Gladinet Hard-Coded Keys RCE Exploitation: Actively exploited hard-coded keys in Gladinet CentreStack and Triofox enable remote code execution.
• Gravity SMTP CVE-2026-4020 API Keys Exposure: CVE-2026-4020 in Gravity SMTP exposes API keys via single HTTP request across 100,000 WordPress sites.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI serving exposure is now a governance problem, not just a patching problem. This flaw is dangerous because the reachable inference path matters as much as the vulnerable dependency. A service that can parse attacker-controlled media before strong authentication or reachability controls is already operating outside a defensible trust boundary. The practitioner conclusion is that AI serving stacks need exposure governance, not only software updates.

The memory-leak stage shows how small disclosure bugs collapse exploitation difficulty. In a modern serving pipeline, one reflected address can turn a hard exploit into a repeatable one. That is why input handling, logging, and error propagation cannot be treated as secondary hygiene in AI infrastructure. The practitioner conclusion is that error channels are part of the attack surface.

Pre-model parsers are part of the identity perimeter for AI infrastructure. Video and image decoders sit upstream of the model, yet they often inherit far less scrutiny than the model API itself. Once an attacker can drive those components through a network endpoint, the serving host becomes a generic execution target. The practitioner conclusion is that parser reachability must be governed with the same seriousness as privileged system access.

AI-serving risk sits at the intersection of NHI controls and application security. The serving process, its API path, and its multimedia dependencies behave like high-value machine identities with privileged access to infrastructure and data. OWASP-NHI and MITRE-ATT&CK both apply here because the problem is not model intelligence, but the abuse of a production execution surface. The practitioner conclusion is that identity and exploit paths need to be managed together.

Identity blast radius is the right concept for AI serving stacks like vLLM. A compromise rarely stops at the process that was directly exploited. The host may hold API keys, prompt traces, model artefacts, and network paths into GPU clusters or adjacent services. The practitioner conclusion is that teams should model the blast radius of a serving node before treating it as a routine application server.

From our research library:

• The average time to mitigate a leaked secret is 36 hours, highlighting the operational burden of manual remediation processes, according to the 2024 State of Secrets Management Survey.
• The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to the State of Secrets in AppSec.
• Read next: Identity and NHI Security Business Case Guide

What this signals

Identity blast radius: AI serving nodes should be treated as high-value execution environments whose compromise can expose prompts, keys, and adjacent infrastructure. That means exposure management has to include network reachability, parser reachability, and the privilege carried by the process itself.

The useful governance question is no longer whether the model endpoint is patched, but whether an unauthenticated or loosely authenticated path can still reach high-risk media parsing code. If it can, the control failure sits in request routing and trust boundary design, not only in vulnerability management.

For practitioners

• Restrict video-enabled inference paths Disable multimodal video support where it is not required, and remove public reachability from any endpoint that can reach the vulnerable parsing code path.
• Enforce network-level exposure checks Inventory which vLLM instances are internet reachable, which routes accept external video_url parameters, and which deployments can be hit before authentication is enforced.
• Harden error handling in serving stacks Strip memory addresses and internal object references from API error responses, especially where parser failures could expose heap state or process internals.
• Treat AI serving nodes as privileged assets Assume a compromised inference host may contain credentials, prompt data, and lateral movement paths, then scope containment and monitoring accordingly.
• Patch vulnerable builds immediately Upgrade vLLM deployments to version 0.14.1 or later and verify that the fixed package is present in every container, source build, and GPU node image.

Key takeaways

• The flaw is dangerous because it turns a public inference path into a remote execution surface through chained parsing weaknesses.
• The article’s evidence shows that leaked runtime state can make exploitation much more reliable than a simple memory bug would suggest.
• Teams should reduce reachable attack surface around AI serving nodes, because patching alone does not remove the trust assumptions that made the exploit possible.

Key terms

• AI Serving Layer: The AI serving layer is the runtime service that accepts prompts, routes requests, and returns model output in production. It matters because this layer often holds network reachability, authentication logic, and access to downstream data or compute, making it a privileged non-human identity boundary rather than a simple application wrapper.
• Information Leak: An information leak is a disclosure flaw that reveals data the caller should not see, such as memory addresses, tokens, or internal state. In exploitation chains, leaks often do the quiet work of making a second-stage bug practical by removing randomness, exposing layout, or confirming that a target is reachable.
• Memory overflow: A memory overflow happens when software writes beyond the space allocated for data, which can corrupt adjacent memory or crash a process. In security contexts, that corruption can become code execution or denial of service if the attacker can shape the input and reach the vulnerable path.
• Attack Surface Reachability: Attack surface reachability is the extent to which an external actor can actually drive a vulnerable code path from a network request. For AI serving systems, this matters because a flaw only becomes exploitable when the endpoint, route, and input type are all reachable in practice.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.