Description

A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file gui_agents/s1/utils/ocr_server.py of the component OCR HTTP API. Executing a manipulation of the argument img_bytes can lead to resource consumption. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-03T05:16:47.167Z",
  "pubdate": "2026-09-03T05:16:47.167Z",
  "executiveSummary": "A resource consumption vulnerability exists in simular-ai Agent-S versions up to 0.3.2, specifically within the OCR HTTP API component.\nThe vulnerability resides in the ImageData function located in gui_agents/s1/utils/ocr_server.py.\nBy manipulating the img_bytes argument, a remote attacker can induce excessive resource consumption, potentially leading to a denial-of-service state.\nThe flaw stems from improper handling or validation of input data processed by the OCR utility.\nThere is no requirement for authentication to trigger this vulnerability, as it is exposed via the remote OCR HTTP API.\nPublic disclosure of the exploit increases the risk of exploitation by unauthorized actors.\nThe vendor has remained unresponsive to disclosure efforts, leaving systems running vulnerable versions at continued risk of service disruption.\nOrganizations using Agent-S should treat this as a high-priority risk, particularly if the OCR API is exposed to untrusted networks.",
  "technicalDetails": "The vulnerability is located within the ImageData function of the file gui_agents/s1/utils/ocr_server.py in the Agent-S OCR HTTP API component. The root cause pertains to an improper validation or resource management mechanism when processing the img_bytes argument passed to the API endpoint.\nThe attack flow initiates when an attacker sends a specially crafted HTTP request to the OCR API interface. Because the OCR server processes input images to perform Optical Character Recognition, it must allocate memory or CPU cycles to decode and analyze the provided byte stream. By providing malformed, excessively large, or computationally complex img_bytes data, the attacker can force the function to consume disproportionate system resources.\nUpon receiving the malicious payload, the ImageData function likely attempts to parse or process the img_bytes without implementing adequate size constraints, type checks, or complexity limits. This can lead to uncontrolled memory allocation or sustained high CPU utilization, effectively exhausting host resources. Since this process occurs within the context of the HTTP server, the resource saturation can cause the service to become unresponsive to legitimate requests, resulting in a denial-of-service condition.\nThis vulnerability is remotely exploitable without the need for prior authentication or elevated privileges. The network exposure is determined by the accessibility of the OCR HTTP API endpoint. If the service is bound to a publicly accessible network interface, any remote actor can trigger the resource exhaustion condition. The exploit is currently publicly disclosed, meaning that automated scripts or malicious actors could target exposed instances with minimal effort.\nThe post-exploitation impact is primarily the degradation or complete cessation of service for the Agent-S infrastructure. While the current description focuses on resource consumption, such vulnerabilities can sometimes be precursors to further instability or potential memory corruption if the underlying libraries processing the img_bytes have their own buffer management flaws. As the vendor has not provided a patch, the mitigation must rely on defensive posture and architectural isolation."
}