CVE-2026-116143

What it actually does

Bypasses the configured security policy limit on the number of scenes that can be selected and processed in the PS, PDF, and XPS decoders, allowing more scenes to be handled than the policy permits and potentially leading to resource exhaustion.

Why it matters to the business

Attackers can cause image-processing services or applications to consume excessive CPU, memory, or disk resources when handling specially crafted files, resulting in degraded performance, service slowdowns, or outages for systems that rely on ImageMagick for document and image workflows.

How an attack unfolds

An attacker crafts a PS, PDF, or XPS file containing a large number of scenes and supplies a specific command-line argument or embedded directive that circumvents the policy-enforced scene limit; when ImageMagick processes the file, the decoder exceeds the intended bounds and exhausts system resources.

How to fix it

Upgrade ImageMagick to version 6.9.13-58 or later for the 6.x branch and 7.1.2-33 or later for the 7.x branch; re-apply and test any custom security policies after the update to ensure the scene limit is enforced.

How to confirm the fix worked

Verify installed version is at or above the fixed releases; attempt to process a test file that previously triggered the bypass and confirm the policy limit is now respected without excessive resource consumption.

Typical attack path

1. Identify an ImageMagick deployment that processes untrusted PS, PDF, or XPS files
2. Craft a file with more scenes than the policy allows combined with the bypass argument
3. Deliver the file to the target application or service
4. Trigger processing through normal workflows or direct invocation
5. Observe resource exhaustion and resulting denial of service

How to detect it

Search application and system logs for ImageMagick invocations involving PS, PDF, or XPS files that coincide with sudden spikes in CPU, memory, or process count; review audit trails for repeated processing of the same or similar files from untrusted sources.

What your security team should do

• Immediately schedule upgrades to the fixed versions across all ImageMagick instances
• Review and tighten security policies for scene limits on PS/PDF/XPS handling if not already restricted
• Monitor for unusual resource spikes during image and document processing jobs
• Consider sandboxing or replacing ImageMagick for high-risk untrusted input workflows until patched