CVE-2026-116095
smg-project smg llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocation
- State
- Published
- Severity
- 6.9 Medium
- Published
- Oct 25, 2026
- Updated
- Oct 29, 2026
- Reserved
- Oct 25, 2026
Description
A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpeg_turbo::decode_jpeg_rgb of the file crates/multimodal/src/jpeg_turbo.rs of the component llm-multimodal. The manipulation leads to uncontrolled memory allocation. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 1.11.0 is able to address this issue. The identifier of the patch is 8f51b57e219a914089e345b704c3c8de37a3bb8e. It is advisable to upgrade the affected component.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C | VulDB |
| 3.0 | 5.3 Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C | VulDB |
| 2.0 | 5.0 Medium | AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
smgsmg-project |
|
References
- VDB-426162 | smg-project smg llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocationvdb-entrytechnical-description
- VDB-426162 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-116095 | CVE Analysis and Reportthird-party-advisory
- Submit #1000796 | SMG Project (smg-project) Shepherd Model Gateway (SMG), llm-multimodal Rust crate v1.7.0, v1.8.0, v1.9.0, v1.10.0, and v1.10.1 Memory Allocation with Excessive Size Valuethird-party-advisory
- https://github.com/smg-project/smg/issues/2361issue-tracking
- https://github.com/smg-project/smg/pull/2569issue-trackingpatch
- https://gist.github.com/Yunzez/24a1bf4c226fbc324ea8da1d202c6d9bexploit
- https://github.com/smg-project/smg/commit/8f51b57e219a914089e345b704c3c8de37a3bb8epatch
- https://github.com/smg-project/smg/releases/tag/v1.11.0patch
- https://github.com/smg-project/smg/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.