Is CVE-2026-49140 actively exploited?

No active exploitation of CVE-2026-49140 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-49140 be exploited remotely?

Yes. CVE-2026-49140 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-49140?

CVE-2026-49140 has a CVSS score of 4.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-49140

MEDIUM

CVE-2026-49140

CWE-770Published: June 1, 2026· Updated: Jun 2, 2026

4.3

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:11.8th

Official Description

Nanobot prior to version 0.2.1 contains a denial of service vulnerability in the Matrix channel media download handler that allows authenticated room members to exhaust process memory and bandwidth by sending media events with missing or invalid size metadata. Attackers can send multiple concurrent Matrix media events with omitted or invalid declared sizes to trigger simultaneous large media downloads that fully materialize response bodies before post-download rejection, consuming process resources until service degradation occurs.

NVD Source

Technical Analysis

CVE-2026-49140 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.