UpHeron
All vulnerabilities

Servers and applications

CVE-2026-114723

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was processed by GD without any resource limit and could exhaust server memory. Upstream fixed this in the…

Severity
Medium 5.3
Published
22 Oct 2026
Last changed
2 Nov 2026
Added to UpHeron
2 Nov 2026
Fixed in
1.6.20, 1.7.5
Sources
NVD, CVE Program

Affected software

SoftwareAffected versions
RoundcubeServers and applications · cna:roundcube|webmail
  • From 1.6.0 before 1.6.20
  • From 1.7.0 before 1.7.5
RoundcubeServers and applications · cpe:a:roundcube:webmail
  • From 1.6.0 before 1.6.20
  • From 1.7.0 before 1.7.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-114723
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-114723