CVE-2026-114723 in Roundcube
Summary
by MITRE • 10/23/2026
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was processed by GD without any resource limit and could exhaust server memory. Upstream fixed this in the commit “Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation”, which applies the memory check on all platforms.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in Roundcube Webmail versions prior to 1.6.20 and 1.7.x before 1.7.5 represents a critical flaw in how image processing resources are managed during thumbnail generation operations. This issue stems from an inconsistency in the application's fallback mechanism when ImageMagick, the primary library for image manipulation, is unavailable or fails to process a specific file format. In such scenarios, Roundcube defaults to using the GD graphics library as a secondary option. The core technical deficiency lies within this fallback logic, specifically regarding how memory constraints are enforced across different operating systems.
Historically, the codebase implemented an available-memory check exclusively for Windows environments when utilizing the GD library. This platform-specific conditional logic created a significant security gap on Unix-like and Linux-based servers where ImageMagick limits were bypassed without any corresponding resource restrictions in the GD fallback path. Consequently, attackers could exploit this discrepancy by uploading or referencing crafted images with excessively large dimensions. Because the server would process these files using GD without enforcing memory caps, it allowed for uncontrolled consumption of system resources.
The operational impact of this vulnerability is primarily centered on Denial of Service (DoS) conditions through resource exhaustion. By repeatedly submitting requests containing malformed or oversized image data, a malicious actor can trigger the GD fallback mechanism to consume all available server memory. This leads to application crashes, service unavailability for legitimate users, and potential instability at the operating system level if swap space is also exhausted. While this does not directly facilitate remote code execution in most standard configurations, it severely degrades the availability of the webmail infrastructure, which is often a critical communication channel for organizations.
From a classification perspective, this vulnerability aligns with CWE-787: Out-of-bounds Write and CWE-400: Uncontrolled Resource Consumption. The lack of proper input validation regarding image dimensions combined with insufficient resource limits places it squarely within the domain of server-side request flaws that lead to system instability. In terms of adversarial tactics, this exploitation vector corresponds to ATT&CK technique T1496: Resource Hijacking, where attackers leverage computational resources for disruptive purposes rather than traditional data theft or persistence mechanisms.
The upstream resolution addressed this issue by ensuring that the memory check is applied uniformly across all supported platforms during thumbnail generation via GD. This fix eliminates the platform-specific disparity and ensures consistent resource management regardless of whether ImageMagick or GD handles the image processing task. Administrators running affected versions must upgrade to Roundcube 1.6.20, 1.7.5, or later immediately to mitigate this risk. Additionally, implementing web application firewall rules that restrict upload sizes for image files and monitoring server memory usage patterns can provide supplementary defense-in-depth measures against potential abuse of similar vulnerabilities in other components.