CVE-2026-84886 Details

A denial-of-service vulnerability exists in Simular-AI Agent-S versions up to 0.3.2, specifically within the OCR HTTP API. The issue arises in the ImageData function of the file gui_agents/s1/utils/ocr_server.py. The vulnerability allows for excessive resource consumption by manipulating the img_bytes argument. This can be exploited remotely, leading to memory exhaustion or CPU overload, causing the OCR service to become unavailable.

To address this vulnerability, it is recommended to implement several measures: Enforce a strict limit on request body sizes before FastAPI/Pydantic processes the JSON. Reject requests with missing, invalid, or excessive Content-Length headers. Cap the length of the img_bytes field both when encoded and after base64 decoding, before any image processing or OCR execution. Additionally, verify image dimensions to ensure they do not exceed a maximum pixel count before converting the image to a NumPy array. Introduce timeouts for OCR execution, per-request memory limits, and concurrency limits for OCR workers. If the OCR API is exposed outside of a trusted local process, require authentication or a scoped token. Finally, return appropriate errors for oversized payloads or invalid images without invoking the OCR process, and add regression tests to cover these scenarios.