Memory Exhaustion Vulnerability in Roundcube Webmail by Idevs
CVE-2026-114723

3.7LOW

Key Information:

Vendor

Roundcube

Status
Webmail
Vendor
CVE Published:
22 October 2026

What is CVE-2026-114723?

The vulnerability in Roundcube Webmail involves a flaw in the handling of resource limits for ImageMagick during thumbnail generation. This issue arises when the software defaults to GD for processing images, bypassing essential memory checks on non-Windows platforms. An attacker can exploit this by providing a specially crafted image, potentially leading to server memory exhaustion. The vulnerability was addressed through upstream commits ensuring that memory resource limits are consistently applied across all platforms, preventing such exploits.

Affected Version(s)

Webmail Linux 1.6.0 < 1.6.20

Webmail Linux 1.7.0 < 1.7.5

References

https://bugs.debian.org/1151279
issue-trackingthird-party-advisory
https://github.com/roundcube/roundcubemail/commit/d28a570...
patch
https://roundcube.net/news/2026/10/19/security-updates-1....
vendor-advisoryrelease-notes

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.