Roundcube Webmail CVE-2026-114723

Exploitation requires a non-Windows server (Linux/Unix), because the pre-patch memory check in rcube_image::convert was gated by a 'WIN' PHP_OS test and skipped everywhere else. The thumbnail path must fall back to PHP GD (i.e. ImageMagick is not used for the conversion), and the attacker must supply an image whose large declared dimensions force GD to allocate excessive memory. Limiting factors: impact is availability-only (no data disclosure or code execution); the GD fallback must actually be in effect; and thumbnail generation is normally invoked when a logged-in user displays a message/attachment, so a victim action (opening the crafted message) is effectively needed despite the UI:N metric.

All signals point to a genuinely low-priority issue rather than a high-CVSS-but-overstated one. The vendor CVSS base score is 3.7 (LOW) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - there is NO confidentiality or integrity impact and only LOW availability impact (memory exhaustion), and attack complexity is HIGH because exploitation depends on the GD fallback path on a non-Windows host. There is no KEV listing, no public exploit identified, and no EPSS score was supplied in the input, so exploitation probability cannot be quantified from the data given. One caveat: the vector asserts PR:N (unauthenticated), but Roundcube thumbnail generation is driven by a user viewing message attachments, so in practice a victim with an active session must open a crafted message - meaning real-world triggering likely involves user interaction and/or an authenticated session not reflected by the PR:N/UI:N metrics; verify with vendor. Net: a resource-exhaustion DoS of limited severity, worth patching in routine maintenance, not an emergency.

An attacker emails a Roundcube user a message containing a crafted image whose declared pixel dimensions are enormous. When the victim opens the message on a non-Windows server where thumbnail generation falls back to PHP GD, GD attempts to allocate memory for the full decoded image with no resource-limit check, exhausting server memory and degrading or crashing the service. No public exploit code is identified at time of analysis, and the attack produces only a transient denial of service.