Summary
Image processing raises PHP’s memory limit based on untrusted image dimensions instead of rejecting excessive work. Avatar size limits are checked after image decoding.
Affected Products
MyBB 1.8.40 (tested in the original report). The original report also identifies earlier 1.8.x releases; consult the vendor advisory for the authoritative range. Fixed in 1.8.41.
Affected Scope
- Product
- MyBB
- Component
- Image thumbnails and avatar uploads
- Affected function
- inc/functions_image.php — check_thumbnail_memory / generate_thumbnail; inc/functions_upload.php
- Affected versions
- MyBB 1.8.40 (tested); consult vendor advisory for full range
- CWE
- CWE-400, CWE-409
Technical Summary
Image processing raises PHP’s memory limit based on untrusted image dimensions instead of rejecting excessive work. Avatar size limits are checked after image decoding.
Prerequisites and Permissions
An account with avatar or image-attachment upload permission. Resource limits outside PHP can constrain the impact.
Affected Locations
inc/functions_image.php — check_thumbnail_memory / generate_thumbnail; inc/functions_upload.php
Reproducible Proof
Use an isolated, memory-limited test environment and a benign high-dimension image. Observe whether the handler raises its configured memory budget and decodes the image before enforcing upload limits. Preserve memory measurements and stop before exhausting shared resources.
Vulnerable Code
$thumbnail_memory = round(($width * $height * $bitdepth * $channels / 8) * 5);
$thumbnail_memory += 2097152;
if($thumbnail_memory > $free_memory) {
class="tok-comment">// ... recompute a bigger limit
@ini_set(&class="tok-comment">#39;memory_limit', $memory_limit);
}
return true;Severity
medium
CVSS
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Technical Analysis
check_thumbnail_memory() estimates memory from image dimensions and raises memory_limit when its estimate exceeds available memory. Thumbnail generation then decodes the image through GD. In the avatar path, the byte-size cap is enforced after this decode, so a file that should be rejected can already have caused a large allocation. Impact depends on external process/container memory limits and upload configuration.
Original MyBB finding 16, submitted 9 August 2026. Vendor announced release 1.8.41 on 16 September and supplied the covered-finding/advisory mapping on 17 September 2026.
Impact
Availability: a user allowed to upload avatars or image attachments can consume excessive memory and disrupt PHP workers. No confidentiality or integrity impact established.
Remediation
Upgrade to MyBB 1.8.41 or a later supported release. Reject images exceeding pixel and decoded-memory budgets. Enforce upload limits before decoding, and retain a hard memory ceiling.
Vendor advisory: https://github.com/advisories/GHSA-7wxq-cgj5-jqg2
Timeline
- Published
- Advisory published
References
Credits
Reported by Aria Akhavan, Haikhavan.