CVE-2026-114723

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was processed by GD without any resource limit and could exhaust server memory. Upstream fixed this in the commit “Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation”, which applies the memory check on all platforms.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://bugs.debian.org/1151279
https://github.com/roundcube/roundcubemail/commit/0bea81121efd96f07432a837f391dbdd0dffa33f
https://github.com/roundcube/roundcubemail/commit/d28a5703294e971a577e3c4f7bfc33362e3f04cf
https://github.com/roundcube/roundcubemail/releases/tag/1.6.20
https://github.com/roundcube/roundcubemail/releases/tag/1.7.5
https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5

Configurations

No configuration.

History

22 Oct 2026, 02:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-22 02:17

Updated : 2026-10-22 16:45

NVD link : CVE-2026-114723

Mitre link : CVE-2026-114723

CVE.ORG link : CVE-2026-114723

JSON object : View

Products Affected

No product.

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-114723", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"repo": "https://github.com/roundcube/roundcubemail/", "vendor": "Roundcube", "product": "Webmail", "versions": [{"status": "affected", "version": "1.6.0", "lessThan": "1.6.20", "versionType": "semver"}, {"status": "affected", "version": "1.7.0", "lessThan": "1.7.5", "versionType": "semver"}], "platforms": ["Linux", "MacOS"], "defaultStatus": "unaffected"}]}], "published": "2026-10-22T02:17:00.190", "references": [{"url": "https://bugs.debian.org/1151279", "source": "cve@mitre.org"}, {"url": "https://github.com/roundcube/roundcubemail/commit/0bea81121efd96f07432a837f391dbdd0dffa33f", "source": "cve@mitre.org"}, {"url": "https://github.com/roundcube/roundcubemail/commit/d28a5703294e971a577e3c4f7bfc33362e3f04cf", "source": "cve@mitre.org"}, {"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.20", "source": "cve@mitre.org"}, {"url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7.5", "source": "cve@mitre.org"}, {"url": "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5", "source": "cve@mitre.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was processed by GD without any resource limit and could exhaust server memory. Upstream fixed this in the commit \u201cFix ImageMagick resource limits bypass by GD fallback during thumbnail generation\u201d, which applies the memory check on all platforms."}], "lastModified": "2026-10-22T16:45:49.550", "sourceIdentifier": "cve@mitre.org"}