vLLM CVE-2026-22778 - PIL BytesIO Memory Leak

Ibrahim Saud@tektrix

•updated Jun 20, 2026•1•0•13

Detects the Python Imaging Library (PIL) memory leak used to bypass ASLR prior to the JPEG2000 heap overflow. This KQL query specifically looks for syslog messages containing 'cannot identify image file' and 'BytesIO object at 0x', which are indicators of this specific memory leak vulnerability being triggered.