Heap-Use-After-Free Vulnerability in Grok Package
Summary
OSV-2026-437: Heap-use-after-free in tf::Executor::_invoke. Affects grok versions >= 1ca9a4ce1b63568ed43aa7c93697114dc6b3fbcb, < 84d94206198d183bce6af08a15ecac78a9f4d951. Fixed in 84d94206198d183bce6af08a15ecac78a9f4d951. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Grok is an open-source image compression library designed to efficiently handle and process image data. It provides various functionalities for image manipulation and optimization, making it a popular choice among developers. However, like many software libraries, Grok is susceptible to vulnerabilities that can compromise its stability and security. The recent heap-use-after-free vulnerability highlights a critical flaw in the tf::Executor component, which can lead to severe consequences if exploited.
Vulnerability Detail
The vulnerability identified in Grok is a heap-use-after-free issue in the tf::Executor::_invoke function. This flaw arises when the program attempts to access memory that has already been freed, leading to potential crashes or arbitrary code execution. The issue was reported through OSS-Fuzz, indicating that it can be triggered under specific conditions, resulting in a crash state characterized by a WRITE operation on freed memory. If exploited, this vulnerability could allow an attacker to manipulate the program's execution flow, leading to data corruption or unauthorized access.
How To Fix
Minimum fixed version
84d94206198d183bce6af08a15ecac78a9f4d951
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can avoid using the affected functionality in tf::Executor until the package is updated. This may involve modifying your code to bypass calls to the _invoke method or using alternative methods that do not trigger the vulnerability.
Conclusion
The heap-use-after-free vulnerability in the Grok package poses significant risks to applications utilizing this library. It is crucial for developers to update to the patched version to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time, ensuring better security for your applications.
See every vulnerability recorded for grok →
FAQ
A heap-use-after-free vulnerability occurs when a program continues to use memory after it has been freed, potentially leading to crashes or exploitation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploiting this vulnerability can lead to crashes, data corruption, or unauthorized access to sensitive information within the application.
Yes, updating to the fixed version of the Grok package will resolve the vulnerability permanently.
If an immediate update is not possible, consider implementing workarounds to avoid using the affected functionality until a proper fix can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for grok.
