CVE-2026-116095
mediumA vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1.
A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpeg_turbo::decode_jpeg_rgb of the file crates/multimodal/src/jpeg_turbo.rs of the component llm-multimodal. The manipulation leads to uncontrolled memory allocation. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 1.11.0 is able to address this issue. The identifier of the patch is 8f51b57e219a914089e345b704c3c8de37a3bb8e. It is advisable to upgrade the affected component.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://gist.github.com/Yunzez/24a1bf4c226fbc324ea8da1d202c6d9b cna@vuldb.com
- https://github.com/smg-project/smg/ cna@vuldb.com
- https://github.com/smg-project/smg/commit/8f51b57e219a914089e345b704c3c8de37a3bb8e cna@vuldb.com
- https://github.com/smg-project/smg/issues/2361 cna@vuldb.com
- https://github.com/smg-project/smg/pull/2569 cna@vuldb.com
- https://github.com/smg-project/smg/releases/tag/v1.11.0 cna@vuldb.com
- https://vuldb.com/cve/CVE-2026-116095 cna@vuldb.com
- https://vuldb.com/submit/1000796 cna@vuldb.com
- https://vuldb.com/vuln/426162 cna@vuldb.com
- https://vuldb.com/vuln/426162/cti cna@vuldb.com
- https://github.com/smg-project/smg/issues/2361 134c704f-9b21-4f2e-91b3-4a467353bcc0