CVE-2026-116158
LowCVSS 2.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers can supply inputs that trigger repeated failed compare operations to exhaust memory and cause denial of service.
Risk Assessment
Repeated failed compare operations may exhaust memory and lead to denial of service, affecting the availability of image-processing systems. The risk affects services processing untrusted input.
Recommendation
Update ImageMagick to version 7.1.2-33 or later. Monitor memory usage and limit processing of untrusted input in the magick compare command until updated.
Other vulnerabilities in ImageMagick
See all- CVE-2017-17880High
In ImageMagick 7.0.7-16 Q16 x86_64, there is a stack-based buffer over-read in WriteWEBPImage in coders/webp.c, related to a WEBP_DECODER_ABI_VERSION check.
- CVE-2017-17879High
In ImageMagick 7.0.7-16 Q16 x86_64, there is a heap-based buffer over-read in ReadOneMNGImage in coders/png.c, related to length calculation and caused by an off-by-one error.
- CVE-2017-16546High
The ReadWPGImage function in ImageMagick 7.0.7-9 does not properly validate the colormap index in a WPG palette, which may lead to denial of service or other unspecified impacts via a malformed WPG file.
- CVE-2017-15281High
The ReadPSDImage function in coders/psd.c in ImageMagick 7.0.7-6 has a vulnerability that allows remote attackers to cause application crashes or potentially other unspecified impacts via a crafted file.
- CVE-2017-15033High
ImageMagick version 7.0.7-2 contains a memory leak in ReadYUVImage in coders/yuv.c.
- CVE-2017-14739High
The AcquireResampleFilterThreadSet function in ImageMagick 7.0.7-4 mishandles failed memory allocation, which can lead to denial of service via NULL Pointer Dereference in DistortImage.
- CVE-2017-14682High
GetNextToken in MagickCore/token.c in ImageMagick 7.0.6 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted SVG document.
- CVE-2017-14137High
The ReadWEBPImage function in coders/webp.c in ImageMagick 7.0.6-5 has an issue with excessive memory allocation that depends only on a length field in a header.
- CVE-2017-13146High
In ImageMagick before version 6.9.8-5 and 7.x before version 7.0.5-6, there is a memory leak in the ReadMATImage function in coders/mat.c.
- CVE-2017-13143High
In ImageMagick before 6.9.7-6 and 7.x before 7.0.4-6, the ReadMATImage function in coders/mat.c uses uninitialized data, which might allow remote attackers to obtain sensitive information from process memory.
Original NVD description (English source)
ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers can supply inputs that trigger repeated failed compare operations to exhaust memory and cause denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS