CVE-2026-116143
Received Received - Intake

Policy Bypass in ImageMagick PS PDF XPS Decoders

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a policy bypass in the PS, PDF and XPS decoders that allows the security policy's list length limit on scene selection to be circumvented. Attackers supplying a specific argument can cause ImageMagick to process more scenes than permitted, potentially exhausting resources.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116143
EUVD
EUVD-2026-109404

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ImageMagick ImageMagick 7.0.0-0
ImageMagick ImageMagick 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a policy bypass in ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33. It affects the PS, PDF, and XPS decoders by allowing attackers to bypass the security policy's scene selection limit using a specific argument. This causes ImageMagick to process more scenes than permitted, potentially leading to resource exhaustion.

Detection Guidance

To detect this vulnerability, check the installed version of ImageMagick using the command: convert --version or magick --version. If the version is below 6.9.13-58 for ImageMagick 6 or below 7.1.2-33 for ImageMagick 7, the system is vulnerable.

Impact Analysis

The vulnerability could lead to resource exhaustion on your system if exploited. It requires local access and has low attack complexity but does not need user interaction or elevated privileges. This means an attacker with local access could cause system availability issues by consuming excessive resources.

Compliance Impact

This vulnerability could potentially impact compliance with standards requiring resource management and availability, such as HIPAA's integrity and availability requirements, by allowing resource exhaustion through bypassing scene limits in PS, PDF, and XPS decoders.

Mitigation Strategies

Immediately update ImageMagick to version 6.9.13-58 or later for ImageMagick 6, or to version 7.1.2-33 or later for ImageMagick 7. If updating is not possible, restrict access to ImageMagick commands and disable processing of PS, PDF, and XPS files until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116143. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart