CVE-2026-116095: smg-project smg llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocation
A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpegturbo::decodejpegrgb of the file crates/multimodal/src/jpegturbo.rs of the component llm-multimodal. The manipulation leads to uncontrolled memory allocation. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 1.11.0 is able to address this issue. The identifier of the patch is 8f51b57e219a914089e345b704c3c8de37a3bb8e. It is advisable to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
smg-project/smg llm-multimodalto a version that resolves this vulnerability.Fixed in 1.11.0Patch 8f51b57e219a914089e345b704c3c8de37a3bb8e
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using the llm-multimodal component in smg-project smg versions 1.7.0, 1.8.0, 1.9.0, 1.10.0, or 1.10.1 are affected.
Does exploitation require authentication or user interaction?
The supplied vector indicates that exploitation is network-reachable and requires neither privileges nor user interaction. A public exploit is available, which may increase the likelihood of attempted exploitation.
What is the recommended remediation?
Upgrade the affected component to smg version 1.11.0. The listed fix is patch 8f51b57e219a914089e345b704c3c8de37a3bb8e.
How can I determine whether an environment needs remediation?
Check the deployed smg version and whether llm-multimodal is present or used. Versions from 1.7.0 through 1.10.1 require an upgrade to address this issue.