CVE-2026-84886
MediumCVSS 5.3Summary
Vulnerability in simular-ai Agent-S up to 0.3.2, affecting the ImageData function in gui_agents/s1/utils/ocr_server.py of the OCR HTTP API component. Manipulating the img_bytes argument leads to resource consumption. The attack can be launched remotely, and the exploit is publicly disclosed.
Risk Assessment
A remote attack could cause excessive resource consumption, potentially leading to service slowdown or outage.
Recommendation
Update Agent-S to a version newer than 0.3.2 if available, or restrict access to the OCR API.
Other vulnerabilities in simular-ai Agent-S
See all- CVE-2026-84887Medium
Vulnerability in simular-ai Agent-S up to 0.3.2, affecting unknown functionality in grounding.py of the Model-generated GUI Action Execution Workflow component, leading to denial of service. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2026-84885Medium
Vulnerability in simular-ai Agent-S versions 0.3.1 and 0.3.2, affecting an unknown function in code_agent.py of the CodeAgent component, leading to denial of service. The attack can be launched remotely, and the exploit is publicly disclosed.
Original NVD description (English source)
A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file gui_agents/s1/utils/ocr_server.py of the component OCR HTTP API. Executing a manipulation of the argument img_bytes can lead to resource consumption. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.