CVE-2026-114723: 
ImageMagick vulnerability analysis and mitigation

CVE-2026-114723 is a Denial of Service vulnerability in Roundcube Webmail caused by improper resource limiting during thumbnail generation. When the rcube_image class falls back from ImageMagick to the GD library, the available-memory check was only applied on Windows platforms, leaving Linux and other Unix-like systems unprotected against crafted images with excessively large dimensions. Affected versions include Roundcube Webmail 1.6.0 through 1.6.19 and 1.7.0 through 1.7.4. The vulnerability was disclosed on October 22, 2026, and carries a CVSS v3.1 base score of 3.7 (Low) (Github Advisory, Feedly).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). In program/lib/Roundcube/rcube_image.php, the convert() method's memory check (mem_check()) was conditionally guarded by a Windows OS check (strtoupper(substr(PHP_OS, 0, 3)) == 'WIN'), meaning the guard was never applied on Linux or macOS hosts. When ImageMagick is unavailable or fails, Roundcube falls back to PHP's GD library to process images; without the memory check, a remotely supplied image with arbitrarily large pixel dimensions can force GD to allocate unbounded memory. The fix, applied in commits d28a570 (1.7.x) and 0bea811 (1.6.x), removes the OS condition so the memory check runs on all platforms (Roundcube Commit 1.7.x, Roundcube Commit 1.6.x). The vulnerability was reported by researcher GoldenSW (Roundcube 1.7.5 Release).

Successful exploitation results in server memory exhaustion, causing the Roundcube Webmail service to become unavailable (Denial of Service). There is no impact on confidentiality or data integrity — the vulnerability is limited to availability. Because the attack requires no authentication and no user interaction, an unauthenticated remote attacker can repeatedly send crafted image attachments to trigger the condition and sustain a denial of service against the mail server (Github Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Exploitation requires high attack complexity (crafting a specifically malformed image), though no privileges or user interaction are needed (Github Advisory).

1. Reconnaissance: Identify internet-facing Roundcube Webmail instances running versions 1.6.0–1.6.19 or 1.7.0–1.7.4 on non-Windows (Linux/macOS) servers, using tools such as Shodan or Censys.
2. Craft malicious image: Create an image file (e.g., JPEG or PNG) with extremely large declared pixel dimensions (e.g., 100,000 × 100,000 pixels) but minimal actual file size, designed to trigger large memory allocation when decoded by PHP's GD library.
3. Deliver the image: Send an email to a mailbox on the target Roundcube server with the crafted image as an attachment, or upload it via any Roundcube feature that triggers thumbnail generation (e.g., inline image in a composed message).
4. Trigger thumbnail generation: When a user (or automated process) views the email, Roundcube's rcube_image::convert() attempts to generate a thumbnail. If ImageMagick is unavailable or fails, it falls back to GD without the memory check on non-Windows platforms.
5. Exhaust server memory: GD attempts to allocate memory proportional to the image dimensions, exhausting available server RAM and causing the Roundcube process (and potentially the web server) to crash or become unresponsive, resulting in a denial of service (Roundcube Commit 1.7.x, Github Advisory).

• Logs: Web server error logs (e.g., Apache/Nginx) showing PHP fatal errors such as Allowed memory size exhausted or Out of memory during image processing requests; Roundcube application logs recording repeated failures in rcube_image::convert().
• Process: PHP-FPM or web server worker processes consuming abnormally high memory (near or at PHP memory_limit) and terminating unexpectedly; repeated spawning and crashing of PHP worker processes.
• Network: Repeated inbound email messages from the same or rotating source addresses containing large image attachments; unusual spikes in SMTP delivery to the Roundcube server followed by web server instability.
• File System: Presence of unusually large image attachment files in the Roundcube temp/cache directory with extreme declared dimensions but small actual file sizes.

Roundcube has released patched versions 1.6.20 and 1.7.5, both published on October 19, 2026; upgrading to these versions is the recommended remediation (Roundcube 1.7.5 Release, Roundcube 1.6.20 Release). As a workaround prior to patching, administrators can implement server-level restrictions on image dimensions and file sizes before they reach Roundcube's processing pipeline, or ensure ImageMagick is properly configured with resource limits so the GD fallback is not triggered. Additionally, setting a conservative PHP memory_limit in php.ini can reduce the severity of memory exhaustion attacks, though it does not eliminate the vulnerability (Feedly).

The vulnerability was reported to Roundcube by researcher GoldenSW and addressed as part of a broad security update that fixed over 20 issues in the 1.6.20 and 1.7.5 releases (Roundcube 1.7.5 Release). The Roundcube project recommended that all production installations be updated immediately. Community reaction on GitHub was positive regarding the comprehensive security release, with multiple users reacting favorably to the update. No significant independent researcher commentary or media coverage specific to this CVE has been identified beyond the standard vulnerability database entries.