Combined Image Style CVE-2026-96377

Exploitation requires a Drupal site with the contributed Combined image style module (versions 0.0.0 through 1.0.7) installed and enabled, and depends on a user-triggered action (CVSS UI:R) that causes the module to perform image-style processing - the specific request or rendering path that drives the unbounded allocation is not detailed in the available advisory text. Limiting factors: the vulnerable module must actually be installed (it is a non-core contrib module, not present in default Drupal), the triggering interaction is needed for the condition to occur, and impact is confined to availability (no data exposure or modification). The complete fix is to update to version 1.0.7 as provided by the vendor.

This is a low-to-moderate priority issue, not an emergency. The CVSS base score of 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) indicates a network-reachable, low-complexity, unauthenticated flaw whose only impact is limited availability loss (A:L) with no confidentiality or integrity impact - consistent with the CWE-770 'Allocation of Resources Without Limits or Throttling' / excessive-allocation (denial-of-service) nature of the bug. The UI:R metric means a user must perform some action (e.g. request or trigger rendering of a resource) for the condition to fire, which bounds real-world severity. The vuln.today decision label is 'this_month', signalling scheduled remediation rather than act_now/emergency. No EPSS score, no CISA KEV listing, and no PoC or exploit reference are present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent: a genuine but modest DoS in a Drupal contributed module, worth patching in routine cycles rather than crisis response. Missing data: EPSS probability is absent, so widespread-scanning likelihood cannot be quantified; the exact allocation trigger is not described in the advisory text provided.

A remote, unauthenticated attacker induces the site to process a request that drives the Combined image style module to allocate resources without an enforced limit, exhausting memory or CPU and degrading or denying service to legitimate users. Because the CVSS vector sets UI:R, the condition depends on a triggering action (such as requesting generation of a styled image) rather than firing fully autonomously. No public exploit code is identified in the available data.