In vLLM, an image format and a cache handle crossed different trust boundaries

Two vLLM vulnerabilities reached executable code through different routes. In one, a file labeled as an image could select an unexpected decoder that delegated to an external interpreter. In the other, a synthetic multimodal cache handle could cause a worker to deserialize untrusted state. Treating both as "model input RCE" misses the preconditions and the correct fix.

In the EPS/Ghostscript case, a file presented as image/png was parsed by Pillow.Image.open, whose automatic format detection could recognize encapsulated PostScript instead. When a vulnerable Ghostscript interpreter was available, the EPS parsing path could reach the already-known CVE-2024-29510 interpreter issue. Researchers demonstrated marker execution under tested vLLM 0.30.0 conditions; the full HTTP-to-effect chain was source-traced rather than fully reproduced. vLLM 0.32.0 limits permitted image formats, and Ghostscript 10.03.1 separately repairs the interpreter primitive.

The security check is not simply "is this file an image?" It is whether this endpoint authorizes this actual decoder and this downstream interpreter for an untrusted client input.

The shared-memory case concerns forged cache handle data crossing from an API-facing path to an internal multimodal worker. A crafted combination of address, monotonic identifier and cache metadata could reach Python pickle.loads despite a general insecure-serialization flag being disabled. The 0.32.0 fix binds handle components with an HMAC and rotates relevant cache identity during eviction. This is a provenance and identity failure, not EPS file handling.

A runtime patch can close an application-specific entry point while an unsafe helper remains elsewhere on the host. Conversely, patching Ghostscript does not repair cache-handle authorization. For each deployed inference endpoint, record the actual decoding libraries, worker configuration, cache protocol, and host tools available to the service principal.

The format advisory and shared-memory advisory support the described mechanisms and tested effects. Neither alone supplies a public victim count, proof of universal remote reachability or proof that a container escaped to its physical host.

The general lesson is to validate the identity of the object after format detection or cache lookup, where the dangerous action is actually performed.