PT-2026-115026 · Ghostscript+2 · Ghostscript+2
CVE-2026-77467
·
Published
2026-10-15
·
Updated
2026-10-15
CVSS v4.0
7.1
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Lychee versions prior to 7.7.0
Description
An issue exists where the software enables ImageMagick PDF support via Ghostscript without applying an effective pre-render limit to PDF page dimensions in the
loadPdf() function of ImagickHandler. An authenticated user can upload a small PDF file containing an oversized /MediaBox variable, causing the readImage() function of Imagick to consume excessive CPU resources. Depending on the QUEUE CONNECTION configuration, this can either occupy a web worker during synchronous processing or clog the shared image-processing queue in asynchronous Docker configurations, delaying other operations.Recommendations
Update to version 7.7.0.
Exploit
Fix
Allocation of Resources Without Limits
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Ghostscript
Imagemagick
Lychee