CVE-2026-84886: simular-ai Agent-S OCR HTTP API ocr_server.py ImageData resource consumption
A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file guiagents/s1/utils/ocrserver.py of the component OCR HTTP API. Executing a manipulation of the argument imgbytes can lead to resource consumption. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
Deployments of simular-ai Agent-S up to version 0.3.2 that expose the OCR HTTP API are remotely reachable by an attacker. The issue is in the ImageData function in gui_agents/s1/utils/ocr_server.py.
Does exploitation require authentication or user interaction?
No. The supplied severity vector indicates no privileges are required and no user interaction is required; the attack vector is network-based and attack complexity is low.
What is the expected impact of successful exploitation?
Manipulating the img_bytes argument can cause resource consumption, resulting in a low availability impact. No confidentiality or integrity impact is indicated.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used. The report also states that the vendor did not respond to early contact regarding the disclosure.