CVE-2026-77467 LycheeOrg CVE debrief

Who should care

Defenders responsible for Lychee photo-management tool deployments should assess exposure and prioritize upgrading to version 7.7.0 or later. They should also verify affected versions, review compensating controls, and monitor for potential CPU consumption issues. Defenders should care about CVE-2026-77467 because it affects Lychee photo-management tool versions before 7.7.0, allowing an authenticated user to cause substantial CPU consumption.

Why it matters

Defenders should care about CVE-2026-77467 because it affects Lychee photo-management tool versions before 7.7.0, allowing an authenticated user to cause substantial CPU consumption. This can impact web workers and image-processing queues, leading to delays. Defenders responsible for Lychee deployments should assess exposure, prioritize upgrading to version 7.7.0 or later, and verify affected versions.

• CPU consumption can occupy a web worker in synchronous processing
• Asynchronous Docker configuration can clog the shared image-processing queue
• Delay other work due to substantial CPU consumption
• Verification of affected versions and remediation priority is necessary

Technical summary

The vulnerability allows an authenticated user to upload a small PDF with an oversized /MediaBox, causing substantial CPU consumption in Lychee versions before 7.7.0. This can impact web workers and image-processing queues, leading to delays. The issue is fixed in version 7.7.0. Defenders should prioritize upgrading to version 7.7.0 or later and assess exposure in their environments. The vulnerability affects Lychee photo-management tool versions before 7.7.0, and defenders should verify affected versions and prioritize remediation.

Defensive priority

Defenders should prioritize upgrading to version 7.7.0 or later and assess exposure in their environments.

Recommended defensive actions

• Upgrade to Lychee version 7.7.0 or later
• Assess exposure in environments using Lychee
• Monitor for potential CPU consumption issues
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Plan vendor-supported updates or mitigations through normal change control

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and fixed version. The vulnerability affects Lychee photo-management tool versions before 7.7.0. An authenticated user can upload a small PDF with an oversized /MediaBox, causing substantial CPU consumption. The issue is fixed in version 7.7.0. Defenders should verify affected versions and prioritize remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.