CVE-2026-116147
Received Received - Intake

Null Pointer Dereference in ImageMagick

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a null pointer dereference in the DJVU decoder because the result of a memory allocation is not checked before use. Attackers can supply a DJVU image that, when processed under conditions where the allocation fails, crashes the process and causes a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116147
EUVD
EUVD-2026-109408

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ImageMagick ImageMagick 7.0.0-0
ImageMagick ImageMagick 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a null pointer dereference in ImageMagick's DJVU decoder. It occurs when memory allocation fails but the result is not checked before use. Attackers can exploit this by providing a specially crafted DJVU image that causes a memory allocation failure, leading to a crash and denial of service.

Detection Guidance

Check ImageMagick version with 'convert --version' or 'magick --version'. If version is below 6.9.13-58 or 7.1.2-33, the system is vulnerable. Monitor for crashes when processing DJVU images.

Impact Analysis

If exploited, this vulnerability can crash the ImageMagick process, causing a denial of service. This means affected systems may become unavailable or unresponsive when processing malicious DJVU images.

Compliance Impact

This vulnerability causes a denial of service by crashing the process, which could impact system availability. For GDPR, availability is part of data integrity and security principles, so prolonged outages may raise compliance concerns. HIPAA requires ensuring availability of systems handling protected health information; crashes could disrupt access to critical data.

Mitigation Strategies

Upgrade ImageMagick to version 6.9.13-58 or later for 6.x branch, or 7.1.2-33 or later for 7.x branch. Avoid processing untrusted DJVU images until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116147. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart