CVE-2026-116095
smg-project smg llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocation
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpeg_turbo::decode_jpeg_rgb of the file crates/multimodal/src/jpeg_turbo.rs of the component llm-multimodal. The manipulation leads to uncontrolled memory allocation. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 1.11.0 is able to address this issue. The identifier of the patch is 8f51b57e219a914089e345b704c3c8de37a3bb8e. It is advisable to upgrade the affected component.
| CWE | CWE-789 CWE-400 |
| Vendor | smg-project |
| Product | smg |
| Published | Oct 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for smg-project smg
Be the first to know when new medium vulnerabilities affecting smg-project smg are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
smg-project / smg
1.7.0 1.8.0 1.9.0 1.10.0 1.10.1
References
vuldb.com: https://vuldb.com/vuln/426162 vuldb.com: https://vuldb.com/vuln/426162/cti vuldb.com: https://vuldb.com/cve/CVE-2026-116095 vuldb.com: https://vuldb.com/submit/1000796 github.com: https://github.com/smg-project/smg/issues/2361 github.com: https://github.com/smg-project/smg/pull/2569 gist.github.com: https://gist.github.com/Yunzez/24a1bf4c226fbc324ea8da1d202c6d9b github.com: https://github.com/smg-project/smg/commit/8f51b57e219a914089e345b704c3c8de37a3bb8e github.com: https://github.com/smg-project/smg/releases/tag/v1.11.0 github.com: https://github.com/smg-project/smg/
Credits
🔍 Zyz3366 (VulDB User)