VulnerabilityAnalyzed

CVE-2026-26047

A denial-of-service vulnerability was identified in Moodle’s TeX formula editor.

MEDIUM 6.5EPSS 0.43%

Does this matter?

Lower severity and a low EPSS score (0.43%). Track it; it rarely justifies an emergency change on its own.

Description

A denial-of-service vulnerability was identified in Moodle’s TeX formula editor. When rendering TeX content using mimetex, insufficient execution time limits could allow specially crafted formulas to consume excessive server resources. An authenticated user could abuse this behavior to degrade performance or cause service interruption.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.43% probability · 37th percentile
CISA KEV: Not listed
Weakness: CWE-400, CWE-770
Affected: moodle/moodle
Source: patrick@puiterwijk.org

References

https://access.redhat.com/security/cve/CVE-2026-26047Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2440905Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.