CVE-2026-84886: Resource Consumption in simular-ai Agent-S

The vulnerability in simular-ai Agent-S (versions 0.3.0, 0.3.1, and 0.3.2) involves the ImageData function within gui_agents/s1/utils/ocr_server.py. An attacker can remotely manipulate the img_bytes argument to trigger excessive resource consumption, potentially leading to denial of service conditions. The flaw does not require privileges or user interaction to exploit. Although the exploit has been publicly disclosed, no official remediation or patch has been released by the vendor.

Successful exploitation can lead to resource exhaustion on the affected system, potentially degrading or denying service availability. Since the attack vector is remote and requires no privileges or user interaction, it increases the risk of automated exploitation attempts. However, there is no indication of code execution or data compromise from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should consider implementing network-level protections such as limiting access to the OCR HTTP API or applying rate limiting to mitigate potential resource exhaustion attacks until an official patch is available.