The EPSS score of 0.00307 (0.3% chance of exploitation in 30 days) is miscalibrated for this vulnerability. The technical severity is modest—CVSS 5.8—but the deployment context of Roundcube as corporate and government email infrastructure fundamentally changes the risk calculus. This is not a typical web vulnerability where opportunistic exploitation drives the probability; it's a high-value target where nation-state reconnaissance teams, criminal spam operations, and APT actors invest disproportionate effort relative to the CVSS base score. One successful exploitation confirms email validity and read status—data with persistent monetization value for spam operations and reconnaissance for targeted attacks. The EPSS model treats all exploitation attempts as fungible; they're not.
This vulnerability has a documented lineage spanning at least a decade across Thunderbird, Apple Mail, Outlook, and now Roundcube—the SVG/CSS parsing differential between server-side sanitization and client-side interpretation is a known, commoditized pattern. The barrier to exploitation is no longer technical skill; it's motivation. That changes the exploitation velocity in ways EPSS cannot anticipate because it is backward-looking and assumes homogeneous attacker populations.
The 'privilege escalation' language in the CVE description is ambiguous and warrants scrutiny. Evidence suggests this is primarily session-level information disclosure (browser-side CSS fetch leaking email validity and activity timing) rather than a true server-side privilege boundary crossing. However, the ambiguity itself is concerning—imprecise threat modeling causes defenders to misallocate resources between information disclosure and access control failures.
The forgotten-infrastructure problem compounds this: corporate Roundcube installations often run for years without patching precisely because touching email infrastructure is perceived as high-risk. These forgotten instances remain exploitable longest, and critically, data already extracted persists indefinitely—the spam operation that confirms 10,000 valid corporate emails through this vector retains that asset forever, even after the patch deploys.
Prioritize patching Roundcube installations regardless of the EPSS score. The temporal exposure window (the lag between patch publication and median deployment in enterprise environments) is measured in months, not days. During that window, every rendered email silently enumerates the recipient. That's not a vulnerability waiting to be exploited—that's an ongoing data bleed.