CVE-2026-85107CWE-400CWE-770denial-of-service

CVE-2026-85107

Medium · published September 3, 2026

CVSS v3.1
4.3
EPSS
1%
Percentile
42.7
In the wild
Unconfirmed
What it is

A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the component Electron Main Process. Performing a manipulation results in allocation of resources. The attack may be initiated remotely. copyImageFromUrl() entry point no longer reachable on current main. That function did exist at v2026.8.3 but was removed by v2026.8.19. The modern copy-image path is Electron-native event.sender.copyImageAt().

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X
EPSS
0.00510 · 42.7th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-09-03T17:06Z
References (4)
https://vuldb.com/cve/CVE-2026-85107 · [email protected]https://vuldb.com/submit/885135 · [email protected]https://vuldb.com/vuln/398314 · [email protected]https://vuldb.com/vuln/398314/cti · [email protected]
EPSS history
Timeline
  • 05 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 03 SEP 12:45Z
    NousResearch hermes-agent Electron Main Process main.ts resourceBufferFromUrl allocation of resources
    cvelistv5