OpenClaw prior to 2026.2.14 decodes Base64‑backed media inputs into memory buffers before verifying that the resulting decoded size stays within allowed limits, which enables an attacker to trigger large memory allocations. The resulting excessive memory consumption can exhaust system resources and cause the application to become unresponsive or crash, yielding a denial of service for legitimate users.

The vulnerability affects OpenClaw software versions before 2026.2.14. No specific sub‑module is identified beyond the media decoding component within the OpenClaw application.

The vulnerability scores a CVSS of 6.8, indicating moderate severity, yet the EPSS score is less than 1% and it is not listed in the CISA KEV catalog, suggesting a low probability of public exploitation. Nevertheless, the attack vector is remote, as an attacker can send a crafted large Base64 payload over the network to invoke the overflow. Once triggered, the allocation of a large buffer could cause memory pressure and lead to a denial of service without elevating privileges or compromising confidentiality.