Memory Leak in ImageMagick Affects Image Processing
CVE-2026-116158

2LOW

Key Information:

Vendor

Imagemagick
Status
Imagemagick
Vendor
CVE Published:
25 October 2026

What is CVE-2026-116158?

ImageMagick prior to version 7.1.2-33 is prone to a memory leak vulnerability in the 'magick compare' command. This issue arises when the application fails to properly clean up resources after an operation fails. Malicious actors can exploit this flaw by providing specially crafted inputs that trigger repeated unsuccessful compare operations, leading to excessive memory consumption. This can result in a denial of service (DoS), impacting the performance and availability of image processing services.

Affected Version(s)

ImageMagick 0 < 7.1.2-33

ImageMagick 7.1.2-33

References

https://github.com/ImageMagick/ImageMagick/security/advis...
vendor-advisory
https://www.vulncheck.com/advisories/imagemagick-before-7...
third-party-advisory

CVSS V4

Score:
2
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.