vLLM JPEG2000 Video RCE Delivery

How the attack works

The attacker sends a POST request to a vLLM OpenAI-compatible endpoint (/v1/chat/completions or /v1/invocations) with a video_url parameter pointing to a malicious Motion JPEG 2000 file. The server fetches and decodes this file; a manipulated 'cdef' box inside the JPEG2000 structure remaps image planes so the decoder writes past the end of a heap buffer. This overflow overwrites a function pointer used for cleanup, replacing it with a call to system() and supplying an attacker-controlled command string as its argument. When the decoder later runs that cleanup routine, the injected command executes on the host, often opening an interactive reverse shell.

Netzilo detection

Why it matters

A successful chain gives the attacker arbitrary command execution on the machine running the vLLM inference server, which can lead to full host compromise, data theft, or use of the server as a pivot point into the rest of the network.

What you can do

• →Restrict which URLs or hosts your vLLM server is allowed to fetch media from (allowlist trusted domains only).
• →Disable or sandbox JPEG2000/Motion JPEG2000 decoding in the image pipeline if it is not required for your use case.
• →Run inference servers with least-privilege service accounts and no outbound shell access, so even a successful overflow cannot reach system().
• →Monitor inference endpoints for POST bodies containing video_url fields paired with JPEG2000 signature indicators (jp2h/cdef boxes, mjp2 codec selectors), and for shell metacharacters or command-substitution strings inside video_url values.

Known benign look-alikes

• Legitimate multimodal inference on genuine Motion JPEG 2000 assets (.mj2/.mjp2) — common in broadcast, archival and digital-preservation pipelines — will match the fetch branch.
• Medical imaging (DICOM), geospatial (JP2/GeoJP2) and scanned-document workflows that pass .jp2/.j2k frame assets to a vision endpoint for legitimate frame analysis.
• Signed or pre-signed media URLs whose query string contains an unencoded pipe, semicolon or backtick immediately followed by a token such as "sh" or "nc" inside a longer parameter.
• Authorised red-team or CVE-validation testing against a lab vLLM instance, which reproduces the exploit body verbatim.
• Sanctioned penetration-testing or network-debug tooling run by an agent that legitimately uses /dev/tcp redirection, nc -e or a mkfifo pipe (impact branch only).
• A request body containing an unrelated base64 blob that happens to begin with the exact 12-byte JP2 signature box encoding (AAAADGpQICANCocK) — i.e. a real JPEG2000 file being sent for a non-video purpose.

References

• https://attack.mitre.org/techniques/T1190/
• https://attack.mitre.org/techniques/T1203/
• https://cwe.mitre.org/data/definitions/122.html
• https://cwe.mitre.org/data/definitions/918.html