CVE-2026-116157

ImageMagick before 7.1.2-33 Memory Leak in PerlMagick Property Reading

Published Oct 25, 2026 CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Description

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading image properties. Attackers can repeatedly trigger property reads through five affected PerlMagick code locations to exhaust memory and cause denial of service.

Analysis

Technical impact

The vulnerability is a memory leak in PerlMagick that occurs when the library fails to free values returned from image property reads. The leak can be triggered by repeatedly calling property reads at five distinct code locations, eventually exhausting system memory and resulting in a denial of service. The weakness includes an uncontrolled memory consumption flaw (CWE‑401) and improper freeing of memory (CWE‑772).

Affected Systems

Vendor ImageMagick, product ImageMagick, affected versions include all releases prior to 7.1.2‑33. Users running any of those versions are susceptible.

Risk and Exploitability

The CVSS score of 4.8 places the CVE in the medium range. EPSS is not available, so the current exploitation probability is unknown. The vulnerability is not listed in CISA KEV, indicating no known widespread exploitation. Attackers would need a way to invoke PerlMagick property reads repeatedly, which usually requires executing code that uses ImageMagick via its Perl bindings. The likely attack vector is local or via a compromised application that processes images with PerlMagick. Prevention through patching mitigates the risk.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ImageMagick

unaffected

Version	Status	Constraints
`0`	affected	< 7.1.2-33
`7.1.2-33`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Imagemagick

Version	Status	Scheme	Platform
`[0,7.1.2-33)`	affected	generic	—
`7.1.2-33`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade ImageMagick to version 7.1.2‑33 or later.
If upgrading is not immediately possible, disable or remove PerlMagick bindings from the application to eliminate the attack surface.
Monitor memory usage of processes that use ImageMagick and restart or terminate them when memory consumption grows close to the system limit.

Generated by OpenCVE AI on October 26, 2026 at 01:24 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4875-1	imagemagick security update

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.111% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pj4h-g4pf-66v3
https://nvd.nist.gov/vuln/detail/CVE-2026-116157
https://www.cve.org/CVERecord?id=CVE-2026-116157
https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-memory-leak-in-perlmagick-property-reading

History

Oct 26, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 26, 2026 12:30 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://nvd.nist.gov/vuln/detail/CVE-2026-116157 https://www.cve.org/CVERecord?id=CVE-2026-116157
Metrics	threat_severity `None`	threat_severity `Low`

Oct 25, 2026 1:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading image properties. Attackers can repeatedly trigger property reads through five affected PerlMagick code locations to exhaust memory and cause denial of service.
Title		ImageMagick before 7.1.2-33 Memory Leak in PerlMagick Property Reading
First Time appeared		Imagemagick Imagemagick imagemagick
Weaknesses		CWE-401
CPEs		cpe:2.3:a:imagemagick:imagemagick::::::::
Vendors & Products		Imagemagick Imagemagick imagemagick
References		https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pj4h-g4pf-66v3 https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-memory-leak-in-perlmagick-property-reading
Metrics		cvssV3_1 `{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'}` cvssV4_0 `{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`