mailpit -- Multi-frame animation bypass of thumbnail pixel budget

2026-09-19 · VuXML entry

Mailpit author reports: The fix for CVE-2026-67446 / GHSA-75mr-qw9x-3r39 ("Thumbnail generation decodes unbounded image dimensions before scaling", patched in v1.30.4) bounds only the width × height of a single frame. The decoded-size budget is still not enforced over frame count, so an animated PNG whose per-frame dimensions sit just under the limit still expands to a multiple of it. A remote, unauthenticated …

Affected versions

• mailpit < 1.31.2

By system

0 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.