Is CVE-2026-12491 actively exploited?

No active exploitation of CVE-2026-12491 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-12491 be exploited remotely?

Yes. CVE-2026-12491 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-12491?

CVE-2026-12491 has a CVSS score of 4.8 (MEDIUM).

HOME VULNERABILITIESCVE-2026-12491

MEDIUM

CVE-2026-12491

CWE-115Published: June 17, 2026· Updated: Jun 17, 2026

4.8

CVSS v3.1

Official Description

A flaw was found in vLLM, an open-source library for large language model inference. This vulnerability arises from improper handling of image metadata, specifically EXIF orientation and PNG transparency (tRNS) data, during image processing. When images are converted to RGB, transparency information may be implicitly discarded or remapped, leading to unexpected rendering of transparent pixels and distortion of input content. This can result in the model misinterpreting image content, potentially affecting the integrity of processed data.

NVD Source

Technical Analysis

CVE-2026-12491 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.