Read the docs
TI-2026-80228 Aliases CVE-2026-116095GHSA-55xq-367r-px8q

smg-project smg uncontrolled memory allocation in JPEG RGB decoding

Priority HIGH 70CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

smg-project smg versions 1.7.0, 1.8.0, 1.9.0, 1.10.0 and 1.10.1 contain an uncontrolled memory allocation flaw in the function jpeg_turbo::decode_jpeg_rgb in crates/multimodal/src/jpeg_turbo.rs of the llm-multimodal component (CWE-400, CWE-789). A remote attacker can trigger the flaw, which can exhaust available memory. CISA's SSVC rates exploitation as PoC, and a public exploit is available, but the CVE is not in CISA KEV. The CVSS 4.0 base score is 6.9 (MEDIUM).

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpeg_turbo::decode_jpeg_rgb of the file crates/multimodal/src/jpeg_turbo.rs of the component llm-multimodal. The manipulation leads to uncontrolled memory allocation. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 1.11.0 is able to address this issue. The identifier of the patch is 8f51b57e219a914089e345b704c3c8de37a3bb8e. It is advisable to upgrade the affected component.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00521 44th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed smg (smg-project): 1.11.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
smg-projectsmg1.7.0; 1.8.0; 1.9.0; 1.10.0; 1.10.11.11.0Patch availableCNA
  • smg Vendorsmg-project Affected 1.7.0; 1.8.0; 1.9.0; 1.10.0; 1.10.1 Fixed in 1.11.0 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:smg-project:smg:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:smg-project:smg:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Upgrade smg to version 1.11.0, which fixes the issue (patch 8f51b57e219a914089e345b704c3c8de37a3bb8e).

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA smg (smg-project) Fixed in 1.11.0

Timeline

  1. 2026-10-25 Threatist record created from CVE-2026-116095
  2. 2026-10-26 Priority changed: MEDIUM → LOW
  3. 2026-10-27 Alias added: GHSA-55xq-367r-px8q
  4. 2026-10-29 CISA SSVC decision points changed
  5. 2026-10-29 Priority changed: LOW → HIGH

References

Exploit 1

Patch 3

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences