Video of Death: Critical vLLM Flaw (CVSS 9.8) Grants Remote Code Execution

A critical RCE vulnerability (CVE-2026-22778, CVSS 9.8) in vLLM allows attackers to achieve arbitrary code execution by sending a malicious video file: an information leak in PIL reveals memory addresses to bypass ASLR, then a heap overflow in the JPEG2000 decoder (OpenCV/FFmpeg) enables hijacking execution. Default vLLM installs often lack authentication, increasing exposure for deployments serving video models; affected vLLM versions are >=0.8.3 and <0.14.1 and administrators are urged to upgrade to 0.14.1+ immediately.