Vulnerability Description
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was processed by GD without any resource limit and could exhaust server memory. Upstream fixed this in the commit “Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation”, which applies the memory check on all platforms.
CVSS Score
LOW
Related Weaknesses (CWE)
References
- https://bugs.debian.org/1151279
- https://github.com/roundcube/roundcubemail/commit/0bea81121efd96f07432a837f391db
- https://github.com/roundcube/roundcubemail/commit/d28a5703294e971a577e3c4f7bfc33
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.20
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.5
- https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
FAQ
What is CVE-2026-114723?
CVE-2026-114723 is a vulnerability with a CVSS score of 3.7 (LOW). Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the available-memory check ...
How severe is CVE-2026-114723?
CVE-2026-114723 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-114723?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.