CVE-2026-84888: Uncontrolled Memory Allocation in RightNow-AI OpenFang

This vulnerability affects the shell_exec function in the crates/openfang-runtime/src/tool_runner.rs file of RightNow-AI OpenFang versions up to 0.6.9. An attacker can remotely trigger uncontrolled memory allocation, potentially leading to denial of service or resource exhaustion. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with attack vector network, low attack complexity, no privileges required, and no user interaction. Public exploit code exists, but the vendor has not responded or issued a fix.

Successful exploitation allows a remote attacker to cause uncontrolled memory allocation in the affected software, which may lead to denial of service or system instability. There is no indication of privilege escalation, code execution, or data confidentiality impact. The availability of public exploit code increases the risk of exploitation, although no active exploitation in the wild is currently known.

No official fix or patch is currently available for this vulnerability. The vendor has not responded to disclosure attempts. Users should monitor vendor communications for updates. Until a patch is released, consider restricting network access to the vulnerable service and applying resource limits to mitigate potential memory exhaustion.