Live › vulnerability › CVE-2026-114723
Go to dashboardRoundcube Webmail's thumbnail code falls back to GD when ImageMagick is unavailable, and the memory check only ran on Windows. A crafted image with large dimensions can therefore make the server exhaust its memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted Roundcube Webmail installations before 1.6.20 or in the 1.7.x line before 1.7.5 on platforms other than Windows are exposed, since the memory check was Windows-only. Installations that run on Windows were already protected, and hosted or managed mail services are handled by their operator.
No product ranges from the sources yet.
grep -i 'RCMAIL_VERSION' program/include/iniset.php or the version shown in the Roundcube admin About page.php -m | grep -i gd.1.6.20 on the 1.6 branch or 1.7.5 on the 1.7 branch.memory_limit is a sufficient workaround.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was processed by GD without any resource limit and could exhaust server memory. Upstream fixed this in the commit “Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation”, which applies the memory check on all platforms.
This page as .md · .json · in your agent: get_signal("CVE-2026-114723")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.