CVE-2026-84886 simular-ai CVE debrief

Who should care

Security teams responsible for simular-ai Agent-S installations, particularly those using versions up to 0.3.2, should be aware of this vulnerability and take defensive measures to mitigate potential resource consumption attacks. Teams should verify their inventory, restrict access to the OCR HTTP API, and monitor for unusual resource consumption patterns. Additionally, implementing compensating controls and reviewing vendor remediation are crucial steps in managing this vulnerability. This vulnerability has been publicly disclosed, and although the vendor was contacted, no response was received. Therefore, it is essential for affected organizations to prioritize mitigation efforts based on the available information from reliable sources like CVE and NVD.

Technical summary

The simular-ai Agent-S up to version 0.3.2 contains a vulnerability in the ImageData function of the gui_agents/s1/utils/ocr_server.py file, which can lead to resource consumption through manipulation of the img_bytes argument in the OCR HTTP API. The attack can be launched remotely and has been publicly disclosed. Affected systems may experience resource consumption if not properly mitigated. It is essential for organizations to take defensive measures to mitigate potential resource consumption attacks via the OCR HTTP API. This includes verifying inventory, restricting access, monitoring for unusual patterns, and implementing compensating controls. The vendor was contacted but did not respond, emphasizing the need for affected organizations to prioritize mitigation efforts based on available information from reliable sources like CVE and NVD.

Defensive priority

Medium-priority vulnerability in simular-ai Agent-S up to 0.3.2, requiring defensive measures against potential resource consumption attacks via the OCR HTTP API.

Recommended defensive actions

• Verify inventory of simular-ai Agent-S installations up to version 0.3.2
• Restrict access to the OCR HTTP API
• Monitor for unusual resource consumption patterns
• Implement compensating controls to mitigate potential resource consumption attacks
• Review vendor remediation and apply patches if available

Evidence notes

Evidence from Vuldb and NVD suggests a vulnerability in simular-ai Agent-S up to 0.3.2, potentially leading to resource consumption through the OCR HTTP API. Further verification is needed to confirm affected scope and vendor remediation. The CVE record was published on 2026-09-03T05:16:47.167Z and has not been modified since then. Security teams should verify inventory, restrict access, and monitor for unusual patterns.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.