https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 00:39:00 +0000 https://cve.radiocsirt.org/vuln/cve-2026-12491 <p><strong>Affected:</strong> vllm-project vLLM, Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI)</p> <p>A flaw was found in vLLM, an open-source library for large language model inference. This vulnerability arises from improper handling of image metadata, specifically EXIF orientation and PNG transparency (tRNS) data, during image processing. When images are converted to RGB, transparency information may be implicitly discarded or remapped, leading to unexpected rendering of transparent pixels and distortion of input content. This can result in the model misinterpreting image content, potentially affecting the integrity of processed data.</p> <p><strong>Affected:</strong> vllm-project vLLM, Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI)</p> <p>A flaw was found in vLLM, an open-source library for large language model inference. This vulnerability arises from improper handling of image metadata, specifically EXIF orientation and PNG transparency (tRNS) data, during image processing. When images are converted to RGB, transparency information may be implicitly discarded or remapped, leading to unexpected rendering of transparent pixels and distortion of input content. This can result in the model misinterpreting image content, potentially affecting the integrity of processed data.</p> https://cve.radiocsirt.org/vuln/cve-2026-12491 https://cve.radiocsirt.org/vuln/ghsa-8jr5-v98p-w75m <p><strong>Affected:</strong> PyPI: vllm</p> <p>## Summary</p> <p>Issue 1: EXIF orientation not normalized → The image orientation processed by the model differs from how humans view it, introducing interpretation bias.</p> <p>Issue 2: PNG tRNS not explicitly flattened before converting to RGB → After conversion, transparent/semi-transparent pixels are rendered unexpectedly, making otherwise subtle overlay elements visible and distorting the input content. (This attack is similar to AlphaDog: RGBA handling is already correct in vLLM, but since tRNS permits RGB images, the correct processing path isn’t taken.)</p> <p>Issue 3 : Pillow only loads the first frame when loading APNG or GIF files.</p> <p>---</p> <p>## Root Cause</p> <p>* **Rotation**: After opening an image, `ImageOps.exif_transpose` is not called to normalize EXIF orientation. * **Transparency**: Only **RGBA→RGB** is flattened with a background; PNGs carrying **`tRNS`** in **`P`/`L`/`RGB + tRNS`** and other non-RGBA modes take the `image.convert(&#34;RGB&#34;)` path, which implicitly discards/remaps transparency semantics.</p> <p>---</p> <p>## Affected Code</p> <p>https://github.com/vllm-project/vllm/blob/16b37f3119918c1e5a39f303e0d0892c65c07a90/vllm/multimodal/image.py#L77-L84</p> <p>https://github.com/vllm-project/vllm/blob/16b37f3119918c1e5a39f303e0d0892c65c07a90/vllm/multimodal/image.py#L37-L43</p> <p>https://github.com/vllm-project/vllm/blob/16b37f3119918c1e5a39f303e0d0892c65c07a90/vllm/multimodal/image.py#L26-L34 &gt; Current state: `ImageOps.exif_transpose` is not used. (Although the `rescale_image_size` function ([https://githu…</p> <p><strong>Affected:</strong> PyPI: vllm</p> <p>## Summary</p> <p>Issue 1: EXIF orientation not normalized → The image orientation processed by the model differs from how humans view it, introducing interpretation bias.</p> <p>Issue 2: PNG tRNS not explicitly flattened before converting to RGB → After conversion, transparent/semi-transparent pixels are rendered unexpectedly, making otherwise subtle overlay elements visible and distorting the input content. (This attack is similar to AlphaDog: RGBA handling is already correct in vLLM, but since tRNS permits RGB images, the correct processing path isn’t taken.)</p> <p>Issue 3 : Pillow only loads the first frame when loading APNG or GIF files.</p> <p>---</p> <p>## Root Cause</p> <p>* **Rotation**: After opening an image, `ImageOps.exif_transpose` is not called to normalize EXIF orientation. * **Transparency**: Only **RGBA→RGB** is flattened with a background; PNGs carrying **`tRNS`** in **`P`/`L`/`RGB + tRNS`** and other non-RGBA modes take the `image.convert(&#34;RGB&#34;)` path, which implicitly discards/remaps transparency semantics.</p> <p>---</p> <p>## Affected Code</p> <p>https://github.com/vllm-project/vllm/blob/16b37f3119918c1e5a39f303e0d0892c65c07a90/vllm/multimodal/image.py#L77-L84</p> <p>https://github.com/vllm-project/vllm/blob/16b37f3119918c1e5a39f303e0d0892c65c07a90/vllm/multimodal/image.py#L37-L43</p> <p>https://github.com/vllm-project/vllm/blob/16b37f3119918c1e5a39f303e0d0892c65c07a90/vllm/multimodal/image.py#L26-L34 &gt; Current state: `ImageOps.exif_transpose` is not used. (Although the `rescale_image_size` function ([https://githu…</p> https://cve.radiocsirt.org/vuln/ghsa-8jr5-v98p-w75m