Roundcube Webmail before version 1.6.20 and 1.7.x before 1.7.5 can bypass ImageMagick resource limits during thumbnail generation. When the image handling falls back from ImageMagick to the GD library, the check that limits available memory is applied only on Windows. On other platforms, a crafted image with extremely large dimensions is processed by GD without any resource limit, which can exhaust the server’s memory and lead to a denial‑of‑service condition. The weakness is a memory management issue classified as CWE‑770.

Affected systems include Roundcube Webmail installations running any version prior to 1.6.20 and any 1.7.x release earlier than 1.7.5.

The CVSS score of 3.7 indicates moderate severity; no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an attacker capable of uploading or delivering a specially crafted image to the webmail interface, which then triggers thumbnail generation. The vulnerability requires that the target runs a non‑Windows platform with the GD library used, and the attacker does not need elevated privileges. If exploited, it would compromise availability by exhausting memory and potentially crashing the webmail service.