CVE-2026-116155

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via Crafted XMP Profile

Published Oct 25, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of XMP profiles by various decoders. Attackers can supply images with a crafted XMP profile that leak memory each time they are processed, leading to resource exhaustion and denial of service.

Analysis

Technical impact

ImageMagick before 6.9.13‑58 and 7.x before 7.1.2‑33 has a memory‑leak flaw in handling XMP profiles when processing images. An attacker can supply images with a crafted XMP profile that consumes memory each time the image is decoded, ultimately exhausting available memory and resulting in a denial of service. This weakness involves improper memory management (CWE‑401) and resource leak conditions (CWE‑772).

Affected Systems

The affected products are ImageMagick released before 6.9.13‑58 and before 7.1.2‑33. Administrators should verify whether their installations fall within these ranges and take appropriate action.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Attackers can supply malicious images with crafted XMP profiles; the flaw is exploitable as long as the target system processes untrusted image data, particularly on public‑facing services. The exploitation leads to resource exhaustion and denial of service.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ImageMagick

unaffected

Version	Status	Constraints
`7.0.0-0`	affected	< 7.1.2-33
`7.1.2-33`	unaffected	—

ImageMagick

unaffected

Version	Status	Constraints
`0`	affected	< 6.9.13-58
`6.9.13-58`	unaffected	—

Configuration 1 [-]

OR	cpe:2.3:a:imagemagick:imagemagick::::::::
	cpe:2.3:a:imagemagick:imagemagick::::::::

No data.

Vendor Product Versions

Imagemagick

Version	Status	Scheme	Platform
`[7.0.0-0,7.1.2-33)`	affected	semver	—
`7.1.2-33`	unaffected	semver	—

Imagemagick

Version	Status	Scheme	Platform
`[0,6.9.13-58)`	affected	generic	—
`6.9.13-58`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update ImageMagick to the latest release (6.9.13‑58, 7.1.2‑33, or later).
If an update is not possible, configure ImageMagick to disable XMP processing or reject images that include XMP profiles.
Enforce strict memory limits and monitor process memory usage for ImageMagick to detect and contain potential exhaustion attempts.

Generated by OpenCVE AI on October 26, 2026 at 01:24 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4875-1	imagemagick security update

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.304% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5jf2-9gcp-q234
https://nvd.nist.gov/vuln/detail/CVE-2026-116155
https://www.cve.org/CVERecord?id=CVE-2026-116155
https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-58-and-7-x-before-7.1.2-33-memory-leak-via-crafted-xmp-profile

History

Oct 26, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 26, 2026 12:30 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://nvd.nist.gov/vuln/detail/CVE-2026-116155 https://www.cve.org/CVERecord?id=CVE-2026-116155
Metrics	threat_severity `None`	threat_severity `Moderate`

Oct 25, 2026 1:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of XMP profiles by various decoders. Attackers can supply images with a crafted XMP profile that leak memory each time they are processed, leading to resource exhaustion and denial of service.
Title		ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via Crafted XMP Profile
First Time appeared		Imagemagick Imagemagick imagemagick
Weaknesses		CWE-401
CPEs		cpe:2.3:a:imagemagick:imagemagick::::::::
Vendors & Products		Imagemagick Imagemagick imagemagick
References		https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5jf2-9gcp-q234 https://www.vulncheck.com/advisories/imagemagick-before-6.9.13-58-and-7-x-before-7.1.2-33-memory-leak-via-crafted-xmp-profile
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`