smg-project smg llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocation
Impact
The smg-project smg versions 1.7.0 to 1.10.1 have a vulnerability in the jpeg_turbo::decode_jpeg_rgb function, leading to uncontrolled memory allocation. The attack can be initiated remotely.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
smg-project · VulDB
smg
6 ranges
smg-project · VulDB
smg
Compare with this publisher’s ranges. This does not inspect your installation.
affected
1.7.0
1.8.0
1.9.0
1.10.0
1.10.1
unaffected
1.11.0
Other versions: unknown
Product identifiers (CPE)
cpe:2.3:a:smg-project:smg:*:*:*:*:*:*:*:*Original source description
A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpeg_turbo::decode_jpeg_rgb of the file crates/multimodal/src/jpeg_turbo.rs of the component llm-multimodal. The manipulation leads to uncontrolled memory allocation. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 1.11.0 is able to address this issue. The identifier of the patch is 8f51b57e219a914089e345b704c3c8de37a3bb8e. It is advisable to upgrade the affected component.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-116095View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.