CVE-2025-66909 is a denial of service vulnerability found in the Turms AI-Serving module version 0.10.0-SNAPSHOT and earlier. The vulnerability stems from the ExtendedOpenCVImage class, which loads images using OpenCV's imread() function without validating the image's dimensions or pixel count prior to decompression. This lack of validation allows an attacker to craft a compressed image file (e.g., PNG) that is deceptively small in compressed form but expands to consume gigabytes of memory when decompressed. When such an image is processed, it causes immediate memory exhaustion, triggering an OutOfMemoryError and crashing the AI service. Since the OCR service that uses this module may be publicly accessible and does not require authentication, an attacker can remotely exploit this vulnerability by uploading malicious images. Multiple such requests can lead to sustained denial of service, rendering the service unavailable. The vulnerability is classified under CWE-409 (Improper Resource Management) and has a CVSS v3.1 score of 7.5, indicating high severity. The attack vector is network-based with low complexity and no privileges or user interaction required. No known exploits are currently reported in the wild, and no patches have been linked yet. The vulnerability impacts availability exclusively, without affecting confidentiality or integrity.

For European organizations, this vulnerability poses a significant risk to the availability of AI-driven OCR services that utilize the Turms AI-Serving module. Organizations relying on automated document processing, identity verification, or other AI-based image analysis services could experience service outages, disrupting business operations and customer-facing services. Critical sectors such as finance, healthcare, government, and telecommunications that deploy OCR for document digitization or verification may face operational downtime. The ease of exploitation and lack of authentication requirements increase the risk of widespread denial of service attacks, potentially leading to reputational damage and financial losses. Additionally, if the affected services are part of larger automated workflows, the disruption could cascade, affecting broader IT infrastructure. Given the growing reliance on AI and machine learning services in Europe, this vulnerability could impact a wide range of industries and public services.

To mitigate this vulnerability, organizations should implement strict validation of image dimensions and pixel counts before decompression to prevent resource exhaustion. Specifically, input images should be checked for maximum allowable width, height, and total pixel count, rejecting any images exceeding safe thresholds. Rate limiting and request throttling should be applied to the OCR service endpoints to reduce the risk of repeated exploitation. Access controls should be enforced to restrict public accessibility of the OCR service, ideally requiring authentication and authorization. Monitoring and alerting for abnormal memory usage or service crashes can help detect exploitation attempts early. If possible, update or patch the Turms AI-Serving module once a fix is released. As a temporary workaround, consider isolating the image processing component in a sandboxed environment with strict memory limits to contain potential crashes. Finally, conduct regular security assessments and code reviews focusing on resource management in image processing components.