CVE-2026-84886CWE-400CWE-404denial-of-service

CVE-2026-84886

Medium · published September 3, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
49.9
In the wild
Unconfirmed
What it is

A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file gui_agents/s1/utils/ocr_server.py of the component OCR HTTP API. Executing a manipulation of the argument img_bytes can lead to resource consumption. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00637 · 49.9th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-404 · Improper Resource Shutdown or Release
Published
2026-09-03T09:16Z
References (5)
https://github.com/hackerguopeng/cve/tree/main/AgentS_OCR_HTTP_Body_Image_DoS_Report · [email protected]https://vuldb.com/cve/CVE-2026-84886 · [email protected]https://vuldb.com/submit/886443 · [email protected]https://vuldb.com/vuln/398135 · [email protected]https://vuldb.com/vuln/398135/cti · [email protected]
EPSS history
Timeline
  • 04 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 02 SEP 20:45Z
    simular-ai Agent-S OCR HTTP API ocr_server.py ImageData resource consumption
    cvelistv5