Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
The vLLM maintainer advisory describes a pre-authentication video URL chain that leaks a heap address through PIL error handling and triggers an OpenCV/FFmpeg JPEG 2000 overflow for server-side code execution. The path applies to video-serving deployments, including deployments configured with an API key.
ASSESSED SYSTEM
Representative public video-capable vLLM inference service using affected v0.8.3 to before v0.14.1, specifically its video URL parsing and decoding path before patch.
OUT OF SCOPE
Text-only and image-only deployments, patched v0.14.1 and later, observed production exploitation, and unrelated vLLM CVEs are outside the assessed path.
Architecture: Standalone LLM / Generative AI (decision tree Q3) — Q2 NO: no autonomous agent tool chain is evidenced; Q3: direct model or inference service path is assessed. Tier 2: Tier 2 representative deployment scenario, bounded to the assessed system; the report does not establish every operator tier.
Documented attack or failure path
- An unauthenticated requester supplied a crafted video URL to a video-enabled inference endpoint.
- PIL error handling exposed an address useful to the exploit chain.
- A malicious JPEG 2000 payload reached the decoder and could execute code in the inference server process.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- The maintainer patched the chain in v0.14.1; the fixed release is not scored as the pre-fix representative.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Containment (Cn) — scenario interval 0.00–0.88 (midpoint 0.44), Tier 2 MVT 0.55 indeterminate | |||
| Cn-1Scope Enforcement | 0.00w 0.12 | The observed pre-auth request path had no effective scope restriction before it reached server execution, supporting the 0.00 anchor for this boundary. | The maintainer identifies invocation of the vulnerable video decoding path before authentication, even where an API key is configured.source: primary report |
Unknown, not N/A: 25 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.25w 0.25 | Inference responds to requests without autonomous external decisions in this bounded serving path. |
| AsAttack Surface Exposure | 1.00w 0.35 | The representative video-capable service is assumed publicly reachable and accepts malicious media pre-authentication; scale is not asserted for every operator. elevated |
| CpCascade Potential | 1.00w 0.20 | No verified System Dependency Graph or DGC is published, so the framework worst-case Cp default applies.GDCP: worst-case default — no verified dependency graph published elevated |
| RfRemediation Feasibility | 0.25w 0.20 | Upgrading to the maintainer’s patched v0.14.1 is an inferred direct repair; actual operator recovery time is not known. |
Nelevated = 2 (dimensions strictly above 0.75) → CRM = 1.15.
Compound Risk Alert. Two or more dimensions are simultaneously elevated (spec 3.2.2); architectural decomposition is recommended before deployment.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.25 | Minimal public provenance: the original report identifies the affected path and event, but no operator assessment pack, signed configuration inventory, or repeated metric battery is published. |
| Ec — Public evaluation coverage | 0.03 | coverage 0.04 (1 of 26 applicable sub-metrics) × independence 0.80 × fidelity 0.95. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.14 | Evidence dated 2026-02-02; age 258 days on the workpaper reference date. Components: T_calendar 0.14 · C_monitor 0.60. Binding term: T_calendar. Evidence reference is 2026-10-18, 258 days after the earliest substantive public evidence (2026-02-02). C_monitor = 0.60 applies the Table 44 conservative default for Tier 2 because usable public monitoring-coverage evidence is unavailable; it does not assert that the deployment had no telemetry. No C_event cap is asserted from the vLLM advisory alone: it establishes an exploitable vulnerability but no dated victim incident or executed attack. No generic C_evidence cap is assigned from missing public inputs alone. These caps describe public-evidence confidence and do not change the normalized-assurance indicative ERS or assert an unreported operational control failure. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.10 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
4.4 midpoint, interval 1.2–7.6; Low-Moderate scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS · 1 record
CVE-2026-22778 CVSS 3.1 Base 9.8 Critical
| Published score | 9.8 |
|---|---|
| CVSS version | 3.1 |
| Metric group | Base |
| Severity | Critical |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Scored by | GitHub maintainer CNA |
| Source record | https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22778.json (accessed 2026-10-18) |
| Affected component | vLLM video decoder in affected inference servers |
| Scope note | The CVE covers the pre-authentication video decoding chain of the assessed video-serving path. |
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
WHAT THIS CASE TEACHES
The maintainer confirms a pre-auth video decoder RCE path; there is no evidence of in-the-wild exploitation.
Sources: Original primary report — vLLM video decoding pre-authentication RCE advisory (2026-02-02)