Smg
Monthly
Memory exhaustion in the llm-multimodal component of smg 1.7.0 through 1.10.1 allows a remote, unauthenticated attacker to exhaust server memory by supplying a JPEG whose header declares enormous dimensions (libjpeg-turbo accepts up to 65500x65500, roughly 12 GiB of RGB output). The libjpeg-turbo path in crates/multimodal/src/jpeg_turbo.rs sizes the decoded buffer with an unchecked width x height x 3 multiplication and applies no ceiling, while the pure-Rust fallback decoder was already bounded at 512 MiB, so only the turbo decode path is exposed. Impact is availability-only (medium severity; no code execution, integrity or confidentiality effect), a public PoC reference exists but is not verified as working exploit code, and vendor fixes are available in 1.11.0. This is a medium-severity denial-of-service issue, not a high-priority emergency.
Memory exhaustion in the llm-multimodal component of smg 1.7.0 through 1.10.1 allows a remote, unauthenticated attacker to exhaust server memory by supplying a JPEG whose header declares enormous dimensions (libjpeg-turbo accepts up to 65500x65500, roughly 12 GiB of RGB output). The libjpeg-turbo path in crates/multimodal/src/jpeg_turbo.rs sizes the decoded buffer with an unchecked width x height x 3 multiplication and applies no ceiling, while the pure-Rust fallback decoder was already bounded at 512 MiB, so only the turbo decode path is exposed. Impact is availability-only (medium severity; no code execution, integrity or confidentiality effect), a public PoC reference exists but is not verified as working exploit code, and vendor fixes are available in 1.11.0. This is a medium-severity denial-of-service issue, not a high-priority emergency.