Riskcovery

CVE-2026-12491

Vllm: vllm: image exif rotation & png trns transparency not normalized, causing mismatch between model input and expectations

State
Published
Severity
4.8 Medium
Published
Jun 17, 2026
Updated
Jul 7, 2026
Reserved
Jun 17, 2026

Read the record on cve.org

Description

A flaw was found in vLLM, an open-source library for large language model inference. This vulnerability arises from improper handling of image metadata, specifically EXIF orientation and PNG transparency (tRNS) data, during image processing. When images are converted to RGB, transparency information may be implicitly discarded or remapped, leading to unexpected rendering of transparent pixels and distortion of input content. This can result in the model misinterpreting image content, potentially affecting the integrity of processed data.

Scores

CVSSScoreVectorSource
3.14.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:Lredhat

Weaknesses

Affected Products

ProductVersions
vLLMvllm-project
  • 0.11.0 to before 0.24.0Affected
Red Hat AI Inference ServerRed Hat
    Red Hat AI Inference ServerRed Hat
      Red Hat AI Inference ServerRed Hat
        Red Hat AI Inference ServerRed Hat
          Red Hat AI Inference ServerRed Hat
            Red Hat AI Inference ServerRed Hat
              Red Hat AI Inference ServerRed Hat
                Red Hat AI Inference ServerRed Hat
                  Red Hat AI Inference ServerRed Hat
                    Red Hat AI Inference ServerRed Hat
                      Red Hat AI Inference ServerRed Hat
                        Red Hat AI Inference ServerRed Hat
                          Red Hat AI Inference ServerRed Hat
                            Red Hat Enterprise Linux AI (RHEL AI) 3Red Hat
                              Red Hat Enterprise Linux AI (RHEL AI) 3Red Hat
                                Red Hat Enterprise Linux AI (RHEL AI) 3Red Hat
                                  Red Hat Enterprise Linux AI (RHEL AI) 3Red Hat
                                    Red Hat Enterprise Linux AI (RHEL AI) 3Red Hat
                                      Red Hat Enterprise Linux AI (RHEL AI) 3Red Hat
                                        Red Hat Enterprise Linux AI (RHEL AI) 3Red Hat
                                          Red Hat OpenShift AI (RHOAI)Red Hat
                                            Red Hat OpenShift AI (RHOAI)Red Hat
                                              Red Hat OpenShift AI (RHOAI)Red Hat
                                                Red Hat OpenShift AI (RHOAI)Red Hat
                                                  Red Hat OpenShift AI (RHOAI)Red Hat
                                                    Red Hat OpenShift AI (RHOAI)Red Hat
                                                      Red Hat OpenShift AI (RHOAI)Red Hat
                                                        Red Hat OpenShift AI (RHOAI)Red Hat

                                                          References

                                                          Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.