OpenClaw before version 2026.3.31 has a decompression bomb flaw in its image processing that does not enforce pixel‑limit guards on sips. An attacker can supply an oversized image file that, when unpacked, consumes excessive memory. The result is a denial of service that can bring the application to a halt or exhaust server resources. The weakness is identified as CWE‑636, a failure to maintain resource limits.

The affected product is OpenClaw and any installation of the OpenClaw application running a Node.js environment with a version older than 2026.3.31. No other versions or vendors were reported to be impacted.

The CVSS base score of 7.1 denotes a high severity, but the EPSS score is below 1%, indicating a very low probability of active exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The attack vector would involve unauthenticated or authenticated users uploading large image files to a vulnerable server, leading to excessive memory usage and denial of service. No exploitation prerequisites beyond image upload are specified, making it straightforward for a threat actor to trigger the denial if the service processes user images without adequate checks.