The vulnerability resides in the jpeg_turbo::decode_jpeg_rgb function within the llm-multimodal component of smg-project smg. Malicious input can trigger an uncontrolled memory allocation, allowing an attacker to exhaust system resources and cause a denial of service. This weakness is a form of resource exhaustion (CWE-400) and unbounded memory allocation (CWE-789).

The bug affects smg-project smg versions 1.7.0 through 1.10.1. Upgrading to version 1.11.0, which contains commit 8f51b57e219a914089e345b704c3c8de37a3bb8e, removes the issue.

The CVSS base score of 6.9 indicates a moderate level of severity, but the fact that the exploit can be initiated remotely and that the exploit code is publicly available raises the risk profile. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting no widespread active exploitation yet. Nevertheless, an attacker who can supply crafted JPEG data to this function can potentially crash the service by allocating large amounts of memory. The attack vector is remote, inferred from the description that the threat can be initiated remotely.