{"id":"CVE-2026-116095","kind":"vulnerability","aliases":["CVE-2026-116095"],"related":[],"title":"smg: JPEG decoder allocates unbounded memory, letting remote requests exhaust server memory","description":"A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpeg_turbo::decode_jpeg_rgb of the file crates/multimodal/src/jpeg_turbo.rs of the component llm-multimodal. The manipulation leads to uncontrolled memory allocation. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 1.11.0 is able to address this issue. The identifier of the patch is 8f51b57e219a914089e345b704c3c8de37a3bb8e. It is advisable to upgrade the affected component.","summary":"The smg project's llm-multimodal component decodes JPEG images in jpeg_turbo::decode_jpeg_rgb without limiting memory allocation, so a crafted image can make the process allocate excessive memory. A remote attacker can use the publicly available exploit to degrade or crash the service.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","llm-gateway","multimodal","rust","self-hosted","smg"],"not_affected_if":["no-image-input","version-1.11.0-or-later"],"how_to_check":"- Check the installed smg version (for example `smg --version` or the lockfile entry) and see whether it is one of 1.7.0, 1.8.0, 1.9.0, 1.10.0 or 1.10.1.\n- Confirm whether the deployment accepts image input for the llm-multimodal path (multimodal requests reaching decode_jpeg_rgb).","fix":"- Upgrade smg to `1.11.0`, which includes patch commit 8f51b57e219a914089e345b704c3c8de37a3bb8e.\n- Until upgraded, limit request body size and image dimensions at the gateway in front of smg.","status":"open","published_at":"2026-10-25T23:17:41+00:00","first_seen_at":"2026-10-25T23:36:15+00:00","triaged_at":"2026-10-25T23:36:55+00:00","updated_at":"2026-10-25T23:36:55+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T23:36:55Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade smg to `1.11.0`, which includes patch commit 8f51b57e219a914089e345b704c3c8de37a3bb8e.\n- Until upgraded, limit request body size and image dimensions at the gateway in front of smg.","reach":"internet","title":"smg: JPEG decoder allocates unbounded memory, letting remote requests exhaust server memory","impact":"medium","summary":"The smg project's llm-multimodal component decodes JPEG images in jpeg_turbo::decode_jpeg_rgb without limiting memory allocation, so a crafted image can make the process allocate excessive memory. A remote attacker can use the publicly available exploit to degrade or crash the service.","category":"ai-tooling","nicknames":[],"who_cares":["smg","llm-gateway","multimodal","rust","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote requests exhaust server memory and crash or stall the service.","analyst_note":"Check the NVD entry and the linked patch commit 8f51b57e219a914089e345b704c3c8de37a3bb8e to confirm whether authentication is required and what input size triggers the allocation.","how_to_check":"- Check the installed smg version (for example `smg --version` or the lockfile entry) and see whether it is one of 1.7.0, 1.8.0, 1.9.0, 1.10.0 or 1.10.1.\n- Confirm whether the deployment accepts image input for the llm-multimodal path (multimodal requests reaching decode_jpeg_rgb).","needs_analyst":true,"not_affected_if":["version-1.11.0-or-later","no-image-input"],"who_is_affected":"Teams running smg 1.7.0 through 1.10.1 that accept image inputs for multimodal requests are exposed, because the flaw is in the JPEG decode path. Deployments that do not process images through llm-multimodal, or that already run 1.11.0, are not affected. Whether a specific deployment reaches the vulnerable code path beyond that is unknown from the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000721,"input_tokens":3454,"output_tokens":752,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116095':15A,18A '-2026':14A,17A '/1.8.0/1.9.0/1.10.0/1.10.1':88C '1.11.0':133C '1.7.0':87C '8f51b57e219a914089e345b704c3c8de37a3bb8e':146C 'abl':135C 'address':137C 'advis':149C 'affect':89C,153C 'ai':20B 'ai-tool':19B 'alloc':4A,51B,60B,114C 'attack':65B,116C 'avail':70B,125C 'compon':38B,104C,154C 'craft':54B 'crash':75B 'crates/multimodal/src/jpeg_turbo.rs':101C 'cve':13A,16A 'decod':3A,39B,45B,95C 'degrad':73B 'excess':61B 'exhaust':10A 'exploit':71B,122C 'file':100C 'function':92C 'gateway':24B 'host':29B 'identifi':81C,141C 'imag':41B,55B 'initi':119C 'issu':139C 'jpeg':2A,40B,43B,46B,93C,96C 'lead':110C 'let':7A 'limit':49B 'llm':23B,36B,106C 'llm-gateway':22B 'llm-multimod':35B,105C 'make':57B 'manipul':109C 'memori':6A,12A,50B,62B,113C 'might':127C 'multimod':25B,37B,107C 'patch':144C 'process':59B 'project':33B,85C 'public':69B,124C 'remot':8A,64B,120C 'request':9A 'rgb':47B,97C 'rust':26B 'self':28B 'self-host':27B 'server':11A 'servic':77B 'smg':1A,30B,32B,84C,86C 'smg-project':83C 'tool':21B 'turbo':44B,94C 'unbound':5A 'uncontrol':112C 'upgrad':130C,151C 'use':67B,129C 'version':132C 'vulner':79C 'without':48B","nicknames":[],"mitigations":[],"who_affected":"Teams running smg 1.7.0 through 1.10.1 that accept image inputs for multimodal requests are exposed, because the flaw is in the JPEG decode path. Deployments that do not process images through llm-multimodal, or that already run 1.11.0, are not affected. Whether a specific deployment reaches the vulnerable code path beyond that is unknown from the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T23:17:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116095","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116095","severity":null,"published_at":"2026-10-25T23:17:41+00:00","modified_at":"2026-10-25T23:17:41+00:00","first_seen_at":"2026-10-25T23:36:15+00:00","fetched_at":"2026-10-25T23:36:15+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}