CVE-2026-108683

zhayujie CowAgent Media Download memory allocation

State: Published
Severity: 5.3 Medium
Published: Oct 11, 2026
Updated: Oct 13, 2026
Reserved: Oct 10, 2026

Description

A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function of the component Media Download Handler. Such manipulation leads to uncontrolled memory allocation. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.2.0 is sufficient to resolve this issue. The name of the patch is b7967210268fc4c0afea1078223e74e7e96a8a54. You should upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C	VulDB
3.0	4.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C	VulDB
2.0	4.0 Medium	AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-789 Uncontrolled Memory Allocation
CWE-400 Resource Consumption

Affected Products

Product	Versions
CowAgentzhayujie	2.1.0Affected 2.1.1Affected 2.1.2Affected 2.1.3Affected 2.1.4Affected 2.1.5Affected 2.1.6Affected 2.1.7Affected 2.1.8Affected 2.1.9Affected 2.2.0Not affected

References

VDB-416391 | zhayujie CowAgent Media Download memory allocationvdb-entry
VDB-416391 | CTI Indicators (IOB, IOC)signaturepermissions-required
CVE-2026-108683 | CVE Analysis and Reportthird-party-advisory
Submit #958015 | zhayujie CowAgent 2.1.6 Denial of Servicethird-party-advisory
https://github.com/lche511/cve/tree/main/CowAgent_Channel_Media_Download_DoS_Reportexploit
https://github.com/zhayujie/CowAgent/commit/b7967210268fc4c0afea1078223e74e7e96a8a54patch
https://github.com/zhayujie/CowAgent/releases/tag/2.2.0patch
https://github.com/zhayujie/CowAgent/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.