## vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled

- 種別: advisory
- 重大度: high
- 関連技術: python
- CVE: CVE-2026-115912
- 公開日時: 2026-10-28T21:15:15.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-6757-hggm-hp2w)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-6757-hggm-hp2w

影響: pip:vllm < 0.32.0 → 0.32.0
Affected - Ecosystem / package: pip / vllm - Affected versions: vLLM MultiModalKwargsItem: assert mm_item is not None, f"Expected an address item for {mm_hash=}" if "address" in mm_item: address = cast(int, mm_item["address"].data) monotonic_id = cast(int, mm_item["monotonic_id"].data) return self._shm_cache.get(address, monotonic_id) return mm_item The dereference lands in the SHM deserializer, which pickle.loads() any chunk tagged as bytes — so attacker bytes staged in the ring buffer are unp…