Unsafe image-format dispatch and processing in vLLM (PYSEC-2026-4346)

Before vLLM 0.32.0, ImageMediaIO did not restrict the decoder selected by Pillow for attacker-controlled image bytes. The MIME label did not constrain the selected format, allowing EPS content to reach host components. On a host with Ghostscript affected by CVE-2024-29510, this can enable command execution with the vLLM process's privileges; with Pillow 12.0.0–12.2.0, it can exhaust media-loading workers. Impact depends on the applicable dependencies and host configuration.