CVE-2026-116158
Received Received - Intake

Memory Leak in ImageMagick via Failed Compare Operations

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers can supply inputs that trigger repeated failed compare operations to exhaust memory and cause denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116158
EUVD
EUVD-2026-109419

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ImageMagick ImageMagick 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ImageMagick before version 7.1.2-33 has a memory leak in the magick compare command. When an operation fails, the software does not clean up memory properly. Attackers can repeatedly trigger failed compare operations to exhaust system memory, causing a denial of service.

Detection Guidance

To detect this vulnerability, monitor ImageMagick processes for excessive memory usage during compare operations. Check for repeated failed compare commands in logs. Use system monitoring tools like top or htop to observe memory consumption by ImageMagick processes.

Impact Analysis

This vulnerability can cause your system to run out of memory due to repeated failed operations. This may lead to slow performance or complete system crashes, disrupting normal operations.

Compliance Impact

This vulnerability causes memory exhaustion leading to denial of service, which primarily impacts system availability. It does not directly affect data confidentiality or integrity, so it has minimal direct impact on compliance with standards like GDPR or HIPAA that focus on data protection.

Mitigation Strategies

Immediately upgrade ImageMagick to version 7.1.2-33 or later. If upgrading is not possible, restrict access to the magick compare command and monitor memory usage closely. Disable unnecessary ImageMagick operations until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116158. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart