CVE-2026-116095 | smg-project smg up to 1.10.1 llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocation (Issue 2361)

October 25, 2026 Yanac

A vulnerability, which was classified as problematic, has been found in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpeg_turbo::decode_jpeg_rgb of the file crates/multimodal/src/jpeg_turbo.rs of the component llm-multimodal. The manipulation leads to uncontrolled memory allocation.

This vulnerability is documented as CVE-2026-116095. The attack can be initiated remotely. Additionally, an exploit exists.

It is advisable to upgrade the affected component.VulDB Recent EntriesRead More