CVE-2026-26047: 
PHP vulnerability analysis and mitigation

CVE-2026-26047 is a denial-of-service vulnerability in Moodle's TeX formula editor caused by insufficient execution time limits when rendering TeX content via the mimetex renderer. An authenticated user can submit specially crafted TeX formulas that cause excessive CPU consumption, leading to degraded performance or a complete service outage. Affected versions include Moodle prior to 4.5.9, 5.0.0–5.0.4 (fixed in 5.0.5), and 5.1.0–5.1.1 (fixed in 5.1.2). The vulnerability was disclosed on February 19, 2026, with a CVSS v3.1 base score of 6.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is uncontrolled resource consumption (CWE-400) combined with allocation of resources without limits or throttling (CWE-770) in Moodle's TeX formula editor. When mimetex processes TeX input, there are no enforced execution time limits, allowing a malicious formula to monopolize CPU resources indefinitely. Exploitation requires only a low-privilege authenticated account and a network-accessible Moodle instance — no special configuration or elevated permissions are needed. No public proof-of-concept code has been identified at this time (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation results in high availability impact — the Moodle server can experience severe performance degradation or a complete service outage, denying access to all platform users. There is no impact on confidentiality or integrity; the attack is purely a resource exhaustion denial-of-service. Because the attack can be triggered by any authenticated user, even low-privileged student accounts on a shared Moodle instance represent a viable threat vector (Red Hat Bugzilla, Red Hat CVE).

There is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation as of the time of this report. The EPSS score is approximately 0.059%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage exists via Tenable Nessus plugin 299831 (Red Hat CVE, Tenable Nessus).

1. Authentication: Log in to the target Moodle instance with any valid user account (e.g., a student or teacher account).
2. Locate TeX editor: Navigate to a content area that supports the TeX formula editor, such as a quiz question, forum post, or assignment submission.
3. Craft malicious formula: Compose a specially crafted TeX formula designed to trigger exponential or unbounded computation during mimetex rendering (e.g., deeply nested or recursively complex expressions).
4. Submit formula: Submit the crafted TeX content through the editor, causing the server to invoke mimetex without execution time limits.
5. Resource exhaustion: The mimetex process consumes excessive CPU resources on the server, degrading performance for all users or causing a complete service outage (Red Hat Bugzilla).

• Logs: Moodle web server logs showing repeated or sustained requests to TeX formula rendering endpoints (e.g., /filter/tex/ or mimetex-related paths) from a single authenticated user.
• Process: Elevated or sustained CPU usage by the mimetex process on the Moodle server; multiple concurrent mimetex child processes that do not terminate in a normal timeframe.
• Network: High volume of authenticated POST requests containing TeX formula content from a single source IP or user account in a short time window.
• System: Server load average spiking unexpectedly without corresponding legitimate user activity, potentially accompanied by PHP or web server timeout errors in application logs.

Administrators should upgrade Moodle to the patched versions: 4.5.9, 5.0.5, or 5.1.2, which enforce proper execution time limits on mimetex rendering. As interim mitigations, consider restricting access to the TeX formula editor to trusted users only (e.g., teachers or administrators), implementing rate limiting on formula submissions, and monitoring server resource usage for anomalies. Red Hat has released security updates addressing this vulnerability for affected distributions (Red Hat CVE, Red Hat Bugzilla).