CVE-2026-116156
Received Received - Intake

Memory Leak in ImageMagick via -set profile Option

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak caused by a missing cleanup when the -set profile option is used. An attacker who induces a user to process images with the -set profile option can leak memory, potentially exhausting resources and causing a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116156
EUVD
EUVD-2026-109417

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ImageMagick ImageMagick 7.0.0-0
ImageMagick ImageMagick 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-116156 is a memory leak vulnerability in ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33. It occurs when the -set profile option is used, as the software fails to release memory properly after processing. This can lead to memory exhaustion and denial of service if an attacker tricks a user into processing images with the vulnerable option.

Detection Guidance

To detect this vulnerability, check the installed version of ImageMagick using the command: convert --version or magick --version. If the version is below 6.9.13-58 or 7.1.2-33, the system is vulnerable.

Impact Analysis

This vulnerability can cause memory exhaustion on affected systems, leading to performance degradation or crashes. It requires user interaction to exploit, as an attacker must convince a user to process images with the -set profile option. The impact is limited to availability, with no direct effect on confidentiality or integrity.

Compliance Impact

This vulnerability primarily causes memory exhaustion through a denial of service, which may impact system availability. It does not directly affect data confidentiality or integrity, so its impact on GDPR or HIPAA compliance is likely minimal unless availability is a critical requirement for compliance.

Mitigation Strategies

Immediately update ImageMagick to version 6.9.13-58 or later for 6.x series, or 7.1.2-33 or later for 7.x series. Avoid using the -set profile option until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116156. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart