AutoGPT CVE-2025-32423

Exploitation requires a valid low-privilege authenticated user account on the target AutoGPT instance (confirmed by CVSS PR:L in the provided vector). The attacker must be able to create or execute workflows that invoke the ExtractTextInformationBlock component specifically - access to this block type is the concrete prerequisite. No special platform configuration or non-default settings are described as required beyond normal authenticated workflow access. Exploitation is limited by the authentication barrier: unauthenticated external parties cannot trigger this flaw. Servers with very large physical RAM (e.g., 512GB+) may experience severe degradation rather than complete crash, depending on concurrent memory pressure. The attack is further limited to the availability dimension only - no data exfiltration or integrity modification is possible through this vector.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-accessible, low-complexity exploitation requiring only low-privilege authentication - any registered AutoGPT user can trigger this. There is no confidentiality or integrity impact (VC:N/VI:N), and the vendor-provided vector rates vulnerable system availability as VA:L; however, the described impact (50GB memory exhaustion per attack request causing service-wide DoS) is operationally consistent with a high-severity availability outcome, suggesting the VA:L rating may understate real-world impact. No EPSS score was provided in available data, and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread exploitation. The combination of low attack complexity, low privilege requirement, and extreme amplification ratio makes this a high-priority patching target for any internet-exposed AutoGPT deployment, despite the moderate aggregate CVSS score. The primary limiting factor is the authentication requirement - unauthenticated external attackers cannot trigger this.

An authenticated low-privilege user logs into an AutoGPT instance, creates a new workflow incorporating the ExtractTextInformationBlock, and submits a crafted approximately 10KB text payload specifically constructed to maximize internal memory allocation. The server expands this into roughly 50GB of in-memory data structures, exhausting available RAM and rendering the AutoGPT service unresponsive to all users. No public proof-of-concept code has been identified, but given the low attack complexity and the deterministic amplification ratio described in the advisory, the attack is straightforward to reproduce by any authenticated user.