High severity · published Jun 18, 2026
CVE-2025-32436
AutoGPT has a DoS vulnerability in AddAudioToVideoBlock
7.1
CVSS
0.3%
EPSS
No
On KEV
Description
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, `AddAudioToVideoBlock` will download and store the video and audio in a temporary directory without deleting before all noded are done. `StepThroughItemsBlock` can be used to iterate `MediaDurationBlock` multiple times. `StepThroughItemsBlock` does not limit the number of loops. In addition, `AddAudioToVideoBlock` does not limit the amount of disk space consumed in the current working directory and does not delete the video after outputing the result. When a malicious user chooses to screen shot many web pages, the disk space will eventually run out, causing a DoS. Version 0.6.63 patches the issue.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AU
AutoGPT · Significant-Gravitas
< 0.6.63 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-32436
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-32436
github.com
https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-g26x-xwc5-7p44
More from AutoGPT
9.8
CVE-2025-62616
AutoGPT has SSRF vulnerability in SendDiscordFileBlock
9.8
CVE-2025-62615
AutoGPT has SSRF vulnerability in ReadRSSFeedBlock
8.8
CVE-2026-55237
AutoGPT SignUp Page has DOM-Based XSS and Open Redirect
8.8
CVE-2026-26020
AutoGPT Affected by Remote Code Execution via Dynamic Module Import in Block Loading (__import__)
8.8
CVE-2026-24780
AutoGPT is Vulnerable to RCE via Disabled Block Execution
