vLLM 0.32.0 closes a multimodal SHM pickle RCE and an EPS-to-Ghostscript path

Turning off insecure serialisation was never the whole serving boundary.

On 20 October 2026, the vLLM project published a batch of GitHub Security Advisories fixed in 0.32.0, which had shipped two days earlier. Two High findings sit on the multimodal path: forged shared-memory cache handles that still reach pickle.loads in the worker, and image bytes that can select Ghostscript through Pillow even when the request claims to be a PNG.

Forged SHM handles still reached pickle.loads with the insecure flag off

GHSA-6757-hggm-hp2w (CVSS 8.8) affects deployments that enable multimodals shared-memory processor cache (--mm-processor-cache-type shm). The cache treats an (address, monotonic_id) pair as authority to dereference ring-buffer memory. An authenticated caller can stage bytes into that buffer through ordinary chat routes, then submit a forged inner carrier on a public scale-out generate path. The worker deserialises the forged object with pickle.loads.

The advisory is explicit that the chain does not need VLLM_ALLOW_INSECURE_SERIALIZATION=1. The live proof used /v1/chat/completions/render for a feature envelope, /v1/chat/completions to stage bytes, and /inference/v1/generate to submit the forged handle. Affected versions are listed through 0.25.1; the patched release is 0.32.0. Credit goes to Patch the Planet (Trail of Bits with OpenAI), found with GPT-5.5-Cyber.

The fix authenticates every SHM carrier with a server-issued HMAC capability bound to cache key, address, and monotonic id, rotates the secret on cache clear, and rejects forged carriers at the scale-out boundary before engine handoff. The worker re-checks the capability before dereference.

EPS labelled as PNG still reached host Ghostscript through Pillow

GHSA-h3rc-j82p-2c3h (CVSS 8.1) is the second High. In 0.30.0, ImageMediaIO handed attacker-controlled image bytes to Pillow format autodetection without an allowlist. The request MIME label did not constrain decoder selection. An EPS payload labelled image/png reached the host Ghostscript binary.

That path is a known sandbox escape on Ghostscript builds affected by CVE-2024-29510. The reporter reproduced a marker-command payload through the PyPI wheel's ImageMediaIO.load_base64() on Debian Ghostscript 10.03.0. The advisory does not claim a new Ghostscript flaw. It claims vLLM's untrusted-format dispatch.

The same boundary also exposes a Pillow-only denial-of-service on versions 12.0.0-12.2.0 via CVE-2026-59203 (negative %%BeginBinary byte count). Published vllm==0.30.0 left Pillow unpinned; source later requires pillow>=12.3.0. Deployments without Ghostscript, or with a build fixed for CVE-2024-29510, sit outside the RCE chain. They still need the format-dispatch fix and a pinned Pillow.

Companion medium advisories in the same 0.32.0 window include DeepSeek-OCR zero-sum PNG engine kills and out-of-vocabulary token ids that trip CUDA asserts. Those are availability stories. The pickle and Ghostscript pair are code-execution stories on the serving edge.

Apache serving stack; maturity is patch-now for SHM and image hosts

vLLM remains Apache-2.0. Activity: tagged 0.32.0 on 18 October 2026 with nine advisories dated 20 October. Maturity for this news: treat any public multimodal SHM cache or image-capable endpoint below 0.32.0 as overdue for upgrade. Demo configs that never enable SHM cache and never accept images are a narrower exposure; production chat multimodal hosts are not.

Upgrade 0.32.0 first; then verify Ghostscript and Pillow on the node

If you run --mm-processor-cache-type shm, expose scale-out multimodal routes, or accept user-supplied images into vLLM media loaders, bump to 0.32.0 tonight. Leave the insecure-serialisation flag off as defence in depth, and stop treating it as proof that pickle is unreachable. After the bump, confirm host Ghostscript is at or above the CVE-2024-29510 fixed line and that Pillow is 12.3.0 or newer. Teams that already pin those dependency versions still need the vLLM dispatch and HMAC changes.

If you only serve text tokens behind a private network with no multimodal SHM path, take the release on your normal cadence, then read the remaining mediums for your exact model families.

Flag-off false comfort, unpinned Pillow, and vulnerable Ghostscript in the image

Operators who treated VLLM_ALLOW_INSECURE_SERIALIZATION=0 as a closed pickle threat model on the SHM path were wrong: the High still fired with the flag off. Container images that install Ghostscript for document tooling beside the inference process widen the EPS chain. Floating Pillow pins let a regenerated environment land on 12.2.x and inherit the EPS hang. Authenticated callers still matter: both Highs assume someone who can reach the HTTP surface under your auth policy.

Patch the serving edge, then re-read which media paths you expose

Pin vLLM 0.32.0 or later, turn SHM multimodal cache back on only after you confirm HMAC rejection of forged handles in your staging harness, and decide whether image upload belongs on the same process that holds model weights. The open Monday question is how many production multimodal fleets treated the insecure-serialisation flag as a completed threat model.