Heap-Use-After-Free Vulnerability in Grok Package
Summary
OSV-2026-304: Heap-use-after-free in tf::Executor::_invoke. Affects grok versions >= 1ca9a4ce1b63568ed43aa7c93697114dc6b3fbcb, < f88afe44754abda59a151d4b547b41a6e6b90f2c. Fixed in f88afe44754abda59a151d4b547b41a6e6b90f2c. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Grok is an open-source image compression library that provides efficient methods for handling and processing images. It is widely used in various applications due to its performance and ease of integration. However, like many software packages, Grok is susceptible to vulnerabilities that can compromise its functionality and security. This particular vulnerability involves a heap-use-after-free issue, which can lead to crashes and potential exploitation.
Vulnerability Detail
The vulnerability identified is a heap-use-after-free issue in the tf::Executor::_invoke function within the Grok package. This flaw allows an attacker to read memory that has already been freed, potentially leading to crashes or arbitrary code execution. The issue was reported through OSS-Fuzz, highlighting the importance of rigorous testing in open-source projects. The crash state indicates that the vulnerability can be triggered during the execution of specific functions, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
f88afe44754abda59a151d4b547b41a6e6b90f2c
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to apply the patch as soon as possible to mitigate any risks associated with the heap-use-after-free issue.
Conclusion
In summary, the heap-use-after-free vulnerability in the Grok package poses significant risks to applications that utilize it. Users are strongly advised to update to the patched version to ensure their systems remain secure. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in real-time.
See every vulnerability recorded for grok →
FAQ
A heap-use-after-free vulnerability occurs when a program continues to use a memory location after it has been freed, potentially leading to crashes or exploitation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
The risks include application crashes and potential exploitation by attackers to execute arbitrary code, which can compromise the security of the system.
Yes, the fixed version of Grok is f88afe44754abda59a151d4b547b41a6e6b90f2c. Users should update to this version to mitigate the vulnerability.
If immediate updates are not possible, monitor your application closely for unusual behavior and consider isolating it from sensitive environments until the patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for grok.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
