CVE-2026-84886

Name of the Vulnerable Software and Affected Versions simular-ai Agent-S versions prior to 0.3.3

Description A remote resource consumption issue exists within the OCR HTTP API component. The problem resides in the ImageData() function located in the gui agents/s1/utils/ocr server.py file. A remote attacker can trigger this by manipulating the img bytes argument.

Recommendations Update simular-ai Agent-S to a version newer than 0.3.2. As a temporary mitigation, restrict access to the ImageData() function within the OCR HTTP API to minimize the risk of exploitation.