High severity · published Jun 18, 2026
CVE-2025-32392
AutoGPT has a DoS vulnerability in LoopVideoBlock
8.7
CVSS
0.4%
EPSS
No
On KEV
Description
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, AutoGPT's LoopVideoBLock allows users to input a video file and process the video, such as looping it 5 times or extending the time, and finally writing it to disk. However, there is no limit on the resources that can be allocated during execution. For example, the number of loops is user-controllable and unlimited. When a malicious attacker loops too many times, the generated video is too large, and after writing it to disk, the disk space is exhausted, eventually causing DoS. Version 0.6.63 patches the issue.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AU
AutoGPT · Significant-Gravitas
< 0.6.63 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-32392
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-32392
github.com
https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-267x-8jx3-gg6w
More from AutoGPT
9.8
CVE-2025-62616
AutoGPT has SSRF vulnerability in SendDiscordFileBlock
9.8
CVE-2025-62615
AutoGPT has SSRF vulnerability in ReadRSSFeedBlock
8.8
CVE-2026-55237
AutoGPT SignUp Page has DOM-Based XSS and Open Redirect
8.8
CVE-2026-26020
AutoGPT Affected by Remote Code Execution via Dynamic Module Import in Block Loading (__import__)
8.8
CVE-2026-24780
AutoGPT is Vulnerable to RCE via Disabled Block Execution
