CVE-2026-116158

ImageMagick before 7.1.2-33 Memory Leak in magick compare

Published Oct 25, 2026 CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed

Description

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers can supply inputs that trigger repeated failed compare operations to exhaust memory and cause denial of service.

Analysis

Technical impact

ImageMagick versions prior to 7.1.2‑33 contain a memory leak in the magick compare command caused by missing cleanup when an operation fails. This flaw allows an attacker to provide crafted input that triggers repeated failed compare operations, each leaking memory. Over time the process exhausts available memory, leading to a denial of service. The vulnerability corresponds to improper disposal of memory resource (CWE‑401) and can impact the availability of any services that depend on ImageMagick for image processing.

Affected Systems

All installations of ImageMagick before version 7.1.2‑33 are affected. Users running earlier releases and invoking the magick compare command with untrusted input are at risk. The issue does not affect newer releases (7.1.2‑33 and later).

Risk and Exploitability

The CVSS score of 2.0 indicates low overall severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by supplying maliciously crafted compare inputs. If an application processes images from external sources, remote exploitation is possible; local exploitation requires the ability to execute the compare command. As the impact is a denial of service, the risk is primarily in availability degradation rather than confidentiality or integrity.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ImageMagick

unaffected

Version	Status	Constraints
`0`	affected	< 7.1.2-33
`7.1.2-33`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Imagemagick

Version	Status	Scheme	Platform
`[0,7.1.2-33)`	affected	semver	—
`7.1.2-33`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the ImageMagick release 7.1.2‑33 or later to eliminate the memory‑leak issue.
If an upgrade is not immediately possible, limit the number of concurrent compare operations or restrict input size to reduce the chance of exhausting memory.
Configure resource limits such as ulimit or container cgroup restrictions so that the system or application cannot be taken down by a memory‑exhaustion attack.

Generated by OpenCVE AI on October 26, 2026 at 01:23 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity High

Privileges Required None

Attack Requirements Present

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.106% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m938-565c-h9qf
https://nvd.nist.gov/vuln/detail/CVE-2026-116158
https://www.cve.org/CVERecord?id=CVE-2026-116158
https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-memory-leak-in-magick-compare

History

Oct 26, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 26, 2026 12:30 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://nvd.nist.gov/vuln/detail/CVE-2026-116158 https://www.cve.org/CVERecord?id=CVE-2026-116158
Metrics	threat_severity `None`	threat_severity `Low`

Oct 25, 2026 1:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers can supply inputs that trigger repeated failed compare operations to exhaust memory and cause denial of service.
Title		ImageMagick before 7.1.2-33 Memory Leak in magick compare
First Time appeared		Imagemagick Imagemagick imagemagick
Weaknesses		CWE-401
CPEs		cpe:2.3:a:imagemagick:imagemagick::::::::
Vendors & Products		Imagemagick Imagemagick imagemagick
References		https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m938-565c-h9qf https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-memory-leak-in-magick-compare
Metrics		cvssV3_1 `{'score': 2.5, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L'}` cvssV4_0 `{'score': 2, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`