CVE-2026-116095

Received Received - Intake

Uncontrolled Memory Allocation in smg 1.11.0

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulDB

Description

A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpeg_turbo::decode_jpeg_rgb of the file crates/multimodal/src/jpeg_turbo.rs of the component llm-multimodal. The manipulation leads to uncontrolled memory allocation. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 1.11.0 is able to address this issue. The identifier of the patch is 8f51b57e219a914089e345b704c3c8de37a3bb8e. It is advisable to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-25

Last Modified

2026-10-25

Generated

2026-10-26

AI Q&A

2026-10-26

EPSS Evaluated

N/A

NVD

CVE-2026-116095

EUVD

EUVD-2026-109575

Affected Vendors & Products

Vendor	Product	Version / Range
smg-project	smg	1.7.0
smg-project	smg	1.8.0
smg-project	smg	1.9.0
smg-project	smg	1.10.0
smg-project	smg	1.10.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability is an uncontrolled memory allocation issue in the smg-project smg software versions 1.7.0 through 1.10.1. It exists in the jpeg_turbo::decode_jpeg_rgb function within the crates/multimodal/src/jpeg_turbo.rs file of the llm-multimodal component. The flaw allows remote attackers to trigger excessive memory usage, potentially leading to system instability or crashes.

Impact Analysis

The vulnerability could allow remote attackers to cause denial-of-service conditions by consuming excessive memory. This may lead to application crashes, degraded performance, or system unavailability. The exploit is publicly available, increasing the risk of real-world attacks.

Mitigation Strategies

Upgrade the smg component to version 1.11.0 or later to address the uncontrolled memory allocation vulnerability in the jpeg_turbo::decode_jpeg_rgb function.

Hi! I’m here to help you understand CVE-2026-116095. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70