CVE-2026-84886: Resource Consumption in simular-ai Agent-S

This vulnerability in simular-ai Agent-S up to version 0.3.2 involves the ImageData function in gui_agents/s1/utils/ocr_server.py. An attacker can remotely manipulate the img_bytes argument to cause excessive resource consumption, potentially leading to denial of service. The flaw relates to improper handling of input data causing resource exhaustion (CWE-400 and CWE-404). The vulnerability has a CVSS 3.1 base score of 6.9 (medium severity) with network attack vector, low attack complexity, no privileges or user interaction required, and limited impact on availability.

Successful exploitation can lead to resource exhaustion on the affected system, potentially degrading service availability or causing denial of service conditions. There is no indication of confidentiality or integrity impact. The vulnerability can be triggered remotely without authentication, increasing the risk of exploitation. Although public exploit code exists, no active exploitation in the wild is currently known.

No official patch or vendor response has been provided. Users should monitor vendor channels for updates. Until a fix is available, consider implementing network-level protections such as rate limiting or filtering to mitigate potential exploitation of the vulnerable OCR HTTP API endpoint. Avoid exposing the vulnerable service to untrusted networks if possible.