Vulnerability · Published Oct 11, 2026 · Assigned by VulDB

CVE-2026-108683zhayujie CowAgent Media Download memory allocation

Medium 4.3

In plain English

A medium-severity uncontrolled resource consumption in CowAgent from zhayujie. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 76.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function of the component Media Download Handler. Such manipulation leads to uncontrolled memory allocation. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.2.0 is sufficient to resolve this issue. The name of the patch is b7967210268fc4c0afea1078223e74e7e96a8a54. You should upgrade the affected component.

Affected products (as reported)

Vendor	Product	Versions
zhayujie	CowAgent	2.1.02.1.12.1.22.1.32.1.42.1.52.1.62.1.7

Weakness: CWE-789, CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

References

VDB-416391 | zhayujie CowAgent Media Download memory allocation vdb-entry
VDB-416391 | CTI Indicators (IOB, IOC) signature, permissions-required
CVE-2026-108683 | CVE Analysis and Report third-party-advisory
Submit #958015 | zhayujie CowAgent 2.1.6 Denial of Service third-party-advisory
https://github.com/lche511/cve/tree/main/CowAgent_Channel_Media_Download_DoS_Report exploit
https://github.com/zhayujie/CowAgent/commit/b7967210268fc4c0afea1078223e74e7e96a8a54 patch
https://github.com/zhayujie/CowAgent/releases/tag/2.2.0 patch
https://github.com/zhayujie/CowAgent/ product