CVE-2026-67446 is a resource exhaustion vulnerability in Mailpit's image thumbnail generation endpoint. A malformed image file declaring extreme dimensions (e.g., 50,000 × 50,000 pixels) in its metadata triggers the imaging.Decode() function to allocate a buffer based on the declared dimensions rather than the actual file size—resulting in gigabyte-scale memory allocation from a kilobyte input. The root cause is a decode-then-check pattern: the code validates image dimensions only after the decoder has already committed to the allocation.
The critical insight for defenders is that the EPSS score of 0.00371 fundamentally misjudges this vulnerability for its actual user population. The precondition—getting a crafted attachment into Mailpit's message store—is trivially satisfied in normal usage. Developers testing spam detection, processing forwarded test emails, or importing samples from security tools are本身就是攻击向量. The message store is a collaboration surface, not a bastion.
The more dangerous exposure is the trigger topology. Unlike traditional DoS vulnerabilities requiring sustained attacker presence, this becomes a permanent timebomb once planted. Any user viewing the message—whether through the UI, API, or automated testing—re-triggers the allocation bomb. The MessageAttachments.vue component means simply opening an email with a malicious attachment exhausts resources for all concurrent users. This transforms a developer tool into an internal denial-of-service vector requiring zero authentication beyond message delivery.
Version 1.30.4 adds dimension validation before Decode()—the correct immediate fix for this endpoint. However, the disintegration/imaging library (abandoned since 2021) places memory management entirely on callers. Audit all other code paths handling image uploads or processing for the same decode-first pattern. The question isn't just whether this endpoint is patched, but whether the fix represents a one-off patch or a systemic architectural change in how Mailpit handles untrusted image data.