CVE-2024-12236: Google Vertex Gemini API

Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days.

A security issue exists in Vertex Gemini API for customers using VPC-SC. By utilizing a custom crafted file URI for image input, data exfiltration is possible due to requests being routed outside the VPC-SC security perimeter, circumventing the intended security restrictions of VPC-SC. No further fix actions are needed. Google Cloud Platform implemented a fix to return an error message when a media file URL is specified in the fileUri parameter and VPC Service Controls is enabled. Other use cases are unaffected.

Affected products

• Google Vertex Gemini API: affected versions not specified

Published 2024-12-10. Last modified 2026-06-17.