CVE-2026-84886 in Agent-S
Summary
by MITRE • 09/03/2026
A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file gui_agents/s1/utils/ocr_server.py of the component OCR HTTP API. Executing a manipulation of the argument img_bytes can lead to resource consumption. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified within simular-ai Agent-S versions up to 0.3.2 represents a significant security risk associated with the OCR HTTP API component, specifically targeting the ImageData function located in the gui_agents/s1/utils/ocr_server.py file. This flaw arises from an improper handling of input data, where the manipulation of the img_bytes argument allows for uncontrolled resource consumption. The core technical issue lies in the application's failure to validate or limit the size and complexity of image data submitted by users before processing it through optical character recognition routines. When a malicious actor provides crafted input that triggers inefficient parsing algorithms or excessive memory allocation, the system can become overwhelmed, leading to severe performance degradation or complete unavailability of service for legitimate users.
From an operational perspective, this vulnerability facilitates a remote denial-of-service attack with minimal effort on the part of the attacker. Since the exploit has been publicly disclosed and is known to be functional, threat actors can easily leverage existing proof-of-concept code to target systems running affected versions. The ability to launch such attacks remotely means that any system exposing the OCR HTTP API endpoint to a network without adequate protective measures is immediately vulnerable. This lack of response from the vendor further exacerbates the risk, as organizations relying on this software may not receive timely patches or guidance for mitigation, leaving them exposed during critical operational periods.
In terms of industry standard classifications, this vulnerability aligns with CWE-400, which describes uncontrolled resource consumption, and potentially CWE-20 regarding improper input validation when considering the root cause related to the img_bytes argument. The attack vector corresponds to ATT&CK technique T1499, specifically endpoint denial of service via application exhaustion or similar methods that leverage software flaws rather than network flooding. This classification highlights the importance of treating API endpoints with the same rigor as traditional web applications, ensuring that all inputs are strictly validated and constrained before being processed by resource-intensive functions like OCR engines.
To mitigate this risk, immediate action is required to address the exposure until a vendor patch becomes available. Organizations should implement network-level controls such as rate limiting on the affected API endpoint to restrict the frequency of requests from single sources. Additionally, deploying web application firewalls with rules designed to detect and block excessively large image payloads or malformed OCR inputs can provide an effective layer of defense. It is also advisable to isolate the OCR service in a containerized environment with strict resource limits, ensuring that even if exploitation occurs, the impact on the broader system infrastructure remains contained. Monitoring logs for unusual spikes in CPU or memory usage associated with the ocr_server.py process will aid in early detection and response to ongoing attacks.