CVE-2026-116095

A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpeg_turbo::decode_jpeg_rgb of the file crates/multimodal/src/jpeg_turbo.rs of the component llm-multimodal. The manipulation leads to uncontrolled memory allocation. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 1.11.0 is able to address this issue. The identifier of the patch is 8f51b57e219a914089e345b704c3c8de37a3bb8e. It is advisable to upgrade the affected component.

• CWE-400
• CWE-789

• https://gist.github.com/Yunzez/24a1bf4c226fbc324ea8da1d202c6d9b
• https://github.com/smg-project/smg/
• https://github.com/smg-project/smg/commit/8f51b57e219a914089e345b704c3c8de37a3bb8e
• https://github.com/smg-project/smg/issues/2361
• https://github.com/smg-project/smg/pull/2569
• https://github.com/smg-project/smg/releases/tag/v1.11.0
• https://vuldb.com/cve/CVE-2026-116095
• https://vuldb.com/submit/1000796
• https://vuldb.com/vuln/426162
• https://vuldb.com/vuln/426162/cti

Published

Oct 25, 2026

Last Modified

Oct 26, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-116071rotki before 1.44.2 contains a weak key derivation vulnerabi…5.9
• CVE-2026-116072Infinity for Reddit through 8.3.4 contains a login cross-sit…5.4
• CVE-2026-116073Leon before commit 50df142 contains a path traversal vulnera…6.5
• CVE-2026-11608The WP Customer Reviews plugin for WordPress is vulnerable t…6.1
• CVE-2026-11609Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-116094A vulnerability was determined in EyouCMS up to 1.8.3. This …7.3
• CVE-2026-116096A weakness has been identified in ggml-org llama.cpp. Affect…5.3
• CVE-2026-116097A security vulnerability has been detected in CloudClassroom…4.3
• CVE-2026-116098A vulnerability was detected in SteelRaven7 Ravenfield 25407…6.3
• CVE-2026-116099A flaw has been found in Fusion Creators Studio SCP Containm…6.3
• CVE-2026-1161A vulnerability was detected in pbrong hrms 1.0.1. The affec…3.5
• CVE-2026-11610A heap buffer overflow flaw was found in the SASL I/O layer …8.8