CVE-2026-116141
Received Received - Intake

Policy Bypass in ImageMagick UHDR Decoder

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because extent checks occur after decoding. Attackers can supply crafted UHDR images with oversized dimensions that are fully decoded before policy limits are enforced, causing excessive resource consumption.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116141
EUVD
EUVD-2026-109402

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ImageMagick ImageMagick 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a policy bypass in ImageMagick's UHDR decoder. It allows attackers to evade image width and height limits because policy checks occur after the image is fully decoded. Crafted UHDR images with oversized dimensions can cause excessive resource consumption during decoding before limits are enforced.

Detection Guidance

To detect this vulnerability, check the ImageMagick version on your system. Run: convert --version or magick --version. If the version is below 7.1.2-33, the system is vulnerable. Monitor network traffic for oversized UHDR image files being processed.

Impact Analysis

This flaw can lead to excessive resource consumption or allocation issues when processing malicious UHDR images. It may cause system slowdowns, crashes, or denial-of-service conditions due to unchecked image dimensions during decoding.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling denial-of-service attacks through excessive resource consumption. GDPR requires data controllers to ensure availability and integrity of personal data, while HIPAA mandates safeguards against unauthorized resource usage. Exploiting this flaw may disrupt systems handling sensitive data, potentially violating availability requirements.

Mitigation Strategies

Immediately upgrade ImageMagick to version 7.1.2-33 or later. If upgrading is not possible, disable the UHDR decoder by modifying the policy file to restrict UHDR image processing. Block or filter oversized UHDR images at the network perimeter.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116141. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart