Elgg CVE-2026-65650

Attacker must hold a valid Elgg user account with permission to upload avatar images, corresponding to CVSS PR:L (low privileges). The vulnerable code paths - resize() and fixOrientation() in Elgg/ImageService.php - are triggered during avatar processing, so the feature must be accessible to the attacker's account role. Elgg must be using the default GD library image processor; the fix's commentary implies alternative processors may have different behavior. Anonymous/unauthenticated exploitation is not possible per the CVSS PR:L vector. The primary limiting factor is account access: closed or invite-only Elgg communities face substantially lower risk than open-registration deployments. The attack affects only availability (A:L) - there is no confidentiality or integrity component.

The CVSS 4.3 score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L accurately reflects the real-world risk profile. The attack is network-reachable with low complexity, but is gated behind authenticated access (PR:L), which materially constrains the attacker pool to registered users. The availability impact is rated Low (A:L), consistent with a service degradation rather than guaranteed complete crash, though in practice a sufficiently large image on a memory-constrained server could cause PHP process termination or OOM kills affecting all concurrent users. No KEV listing and no public exploit identified at time of analysis, so this is not an actively-weaponized issue. EPSS data was not provided; the risk is primarily relevant to Elgg deployments that permit open user registration, as closed communities significantly reduce exposure. This is a genuine but bounded risk - not a high-priority emergency, but warranting prompt patching given the low attacker effort required once an account is obtained.

An authenticated Elgg user obtains or generates an image with extreme pixel dimensions - for example, a valid PNG file with metadata declaring a 30,000 x 30,000 pixel canvas - and uploads it as their profile avatar. Elgg's ImageService calls the GD library to resize the image without first inspecting its dimensions, causing PHP to allocate several gigabytes of memory for the uncompressed pixel buffer; on a server with limited RAM this triggers an OOM kill or process crash, denying service to all concurrent users. No public exploit code has been identified at time of analysis, though the attack technique requires no specialized tooling beyond an image editor or simple script.