Description
This module detects vLLM OpenAI-compatible servers affected by CVE-2026-22778. When an invalid image is sent to a multimodal endpoint, Pillow (PIL) raises UnidentifiedImageError whose message includes the Python repr of the underlying BytesIO buffer ("<_io.BytesIO object at 0x...>"), exposing a live heap address. Vulnerable versions return that error message directly to the client, which weakens ASLR and forms the first stage of a chain that ends in a JPEG2000 heap overflow in the bundled FFmpeg/OpenCV video decoder. Affected versions are 0.8.3 through 0.14.0 (fixed in 0.14.1, which sanitizes the address out of the message).
The module first reads the unauthenticated /version banner and compares it against the affected range. It then issues a single benign request to the chat completions endpoint containing a deliberately malformed base64 image. If the response leaks a "0x" heap address the target is reported vulnerable with high confidence; if the address is stripped the fix is present; if the server reports that the model has no image support the leak path is not reachable as deployed. The probe never sends a video URL and never reaches the heap-overflow code path.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use auxiliary/scanner/http/vllm/multimodal_info_leakmsf undefined(multimodal_info_leak) > show actions ...actions...msf undefined(multimodal_info_leak) > set ACTION < action-name >msf undefined(multimodal_info_leak) > show options ...show and set options...msf undefined(multimodal_info_leak) > runPrioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub