CVE-2026-77467: Lychee Photo Management DOS Vulnerability

CVE-2026-77467 is a denial of service vulnerability in Lychee photo-management tool affecting versions before 7.7.0. Attackers can upload malicious PDFs with oversized dimensions to exhaust CPU resources and block processing queues. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-77467 Overview

Lychee is a free, open-source photo-management tool. Versions prior to 7.7.0 enable ImageMagick PDF support with Ghostscript but do not apply an effective pre-render limit to PDF page dimensions in the ImagickHandler::loadPdf() method. An authenticated user who uploads a small PDF with an oversized /MediaBox can cause Imagick::readImage() to consume substantial CPU before failing to produce an image. The condition qualifies as a resource exhaustion flaw [CWE-400]. The issue is fixed in version 7.7.0.

Critical Impact
Authenticated attackers can occupy web workers or clog shared image-processing queues, delaying legitimate requests and degrading availability of the Lychee instance.

Affected Products

Lychee photo-management tool, all versions prior to 7.7.0
Deployments using synchronous QUEUE_CONNECTION processing
Official asynchronous Docker configurations sharing an image-processing queue

Discovery Timeline

2026-10-15 - CVE-2026-77467 published to NVD
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-77467

Vulnerability Analysis

Lychee integrates ImageMagick with Ghostscript to render PDF uploads into image previews. The ImagickHandler::loadPdf() method invokes Imagick::readImage() without validating the declared PDF page dimensions before rasterization. A malicious PDF only needs to declare an oversized /MediaBox entry to trigger disproportionate CPU usage during the render attempt. The render ultimately fails, but the resources spent before failure are substantial. The advisory did not identify a Ghostscript sandbox escape, so the impact is scoped to availability.

Root Cause

The root cause is missing input validation on PDF metadata prior to invoking ImageMagick. Lychee did not enforce a pre-render limit on PDF page dimensions, so attacker-controlled /MediaBox values flowed directly into Ghostscript's rendering pipeline. The absence of this guard allows a tiny file to request a huge raster surface.

Attack Vector

Exploitation requires an authenticated account with permission to upload files. The attacker uploads a crafted small PDF containing an oversized /MediaBox. When Lychee processes the file, Imagick::readImage() burns CPU attempting the render. Under synchronous QUEUE_CONNECTION, the request ties up a web worker. Under the official asynchronous Docker configuration, repeated submissions clog the shared image-processing queue and delay other jobs.

php

 use App\DTO\ImageDimension;
 use App\Exceptions\ImageProcessingException;
 use App\Exceptions\MediaFileOperationException;
+use App\Exceptions\MediaFileUnsupportedException;
 use App\Facades\Helpers;
 use App\Image\Files\FlysystemFile;
 use App\Image\Files\InMemoryBuffer;

Source: GitHub Commit 1e92846 - the patch introduces a MediaFileUnsupportedException path so oversized PDF uploads are rejected before CPU-intensive rasterization begins.

Detection Methods for CVE-2026-77467

Indicators of Compromise

Lychee worker processes showing sustained high CPU usage tied to gs (Ghostscript) or convert child processes
Repeated PDF upload events from a single authenticated user followed by failed image-processing jobs
Growing backlog or stalled jobs in the Lychee image-processing queue
Web requests to upload endpoints that time out while the backend remains busy

Detection Strategies

Alert on anomalous CPU time per PDF upload exceeding a baseline for the Lychee workload
Correlate authenticated upload events with downstream Imagick::readImage() failures in application logs
Monitor Ghostscript process runtime and memory footprint spawned by the Lychee PHP workers

Monitoring Recommendations

Track queue depth and job latency for the Lychee image-processing queue
Log and retain the raw dimensions parsed from PDF /MediaBox entries at ingestion
Enable rate-limit telemetry on upload endpoints per authenticated principal

How to Mitigate CVE-2026-77467

Immediate Actions Required

Upgrade Lychee to version 7.7.0 or later
Restrict PDF upload permissions to trusted authenticated users where feasible
Apply CPU and memory limits (cgroups, container limits) to Lychee worker processes

Patch Information

The fix is included in Lychee v7.7.0. Details are available in the GitHub Security Advisory GHSA-6736-fhxv-3p79, the GitHub Pull Request #4511, and the GitHub Release v7.7.0. The patch rejects oversized PDF uploads before invoking Imagick::readImage().

Workarounds

Disable PDF upload support in Lychee until the upgrade is applied
Harden the ImageMagick policy.xml to constrain resource usage for the PDF and coder modules
Switch QUEUE_CONNECTION to an isolated asynchronous worker pool so PDF jobs cannot block interactive requests
Enforce per-user upload rate limits at the reverse proxy or application layer

bash

# Example ImageMagick policy.xml hardening to cap resources for PDF rendering
# Place in /etc/ImageMagick-6/policy.xml or equivalent path for your distribution
<policymap>
  <policy domain="resource" name="memory" value="256MiB"/>
  <policy domain="resource" name="map" value="512MiB"/>
  <policy domain="resource" name="width" value="8KP"/>
  <policy domain="resource" name="height" value="8KP"/>
  <policy domain="resource" name="time" value="30"/>
  <policy domain="coder" rights="none" pattern="PDF"/>
</policymap>