CVE-2026-116141

What it actually does

Allows bypassing image dimension policy limits in the UHDR decoder by performing extent checks after full decoding, leading to excessive memory and CPU consumption during image processing.

Why it matters to the business

Systems using affected ImageMagick versions for image handling may experience denial of service from resource exhaustion when processing malicious images, potentially disrupting services that rely on image manipulation.

How an attack unfolds

An attacker creates a specially crafted UHDR image file with dimensions exceeding configured policy limits. When this image is processed by vulnerable ImageMagick, the decoder fully decodes the image before enforcing the policy checks, resulting in high resource usage that can crash or slow down the application.

How to fix it

Upgrade ImageMagick to version 7.1.2-33 or later to ensure extent checks occur before decoding.

How to confirm the fix worked

Verify the installed version is 7.1.2-33 or newer. Test by attempting to process a UHDR image with dimensions beyond policy limits and confirm it is rejected without excessive resource use.

Typical attack path

1. Craft malicious UHDR image with oversized dimensions
2. Deliver the image to a target application using ImageMagick for processing
3. Trigger decoding of the image
4. Observe resource exhaustion leading to DoS

How to detect it

Monitor logs for ImageMagick processes consuming high CPU or memory when handling UHDR images. Check for error patterns related to policy bypass attempts.

What your security team should do

• Immediately upgrade all ImageMagick installations to the fixed version
• Review and enforce strict image processing policies
• Monitor for unusual resource consumption in image processing services