Resource Exhaustion Vulnerability in Lychee Photo Management Tool
CVE-2026-77467
7.1HIGH
What is CVE-2026-77467?
Lychee, a popular open-source photo management tool, has a vulnerability in its PDF processing capabilities due to insufficient pre-render limits for PDF dimensions. This flaw, present in versions prior to 7.7.0, allows an authenticated user to upload a PDF with an oversized /MediaBox. The resulting image processing can significantly overconsume CPU resources, leading to decreased performance and potential denial of service conditions. The problem arises when using ImageMagick's readImage function, particularly vulnerable under synchronous request processing. The issue has been addressed in version 7.7.0, ensuring that users upgrade to mitigate these risks.
Affected Version(s)
Lychee < 7.7.0