CVE-2026-116147

What it actually does

Null pointer dereference in the DJVU decoder caused by unchecked result of a memory allocation, leading to process crash when allocation fails during image processing.

Why it matters to the business

Applications relying on ImageMagick for image handling may experience unexpected crashes and service interruptions when processing certain DJVU files under memory-constrained conditions.

How an attack unfolds

An attacker crafts a DJVU image that triggers a memory allocation failure inside the decoder; when the allocation result is used without a check the null pointer is dereferenced, terminating the process and producing a denial of service.

How to fix it

Upgrade ImageMagick to version 6.9.13-58 or 7.1.2-33 or later; rebuild any dependent applications against the patched library and restart affected services.

How to confirm the fix worked

Confirm the installed ImageMagick version meets or exceeds the fixed releases; attempt to process a minimal DJVU that previously triggered the crash and verify the process remains stable.

Typical attack path

1. Identify a target service that accepts and processes DJVU images via ImageMagick
2. Prepare a DJVU payload engineered to cause allocation failure during decode
3. Deliver the payload over the network or via file upload
4. Trigger processing of the image, inducing the null dereference and crash

How to detect it

Review application and system logs for ImageMagick crashes or segmentation faults occurring during DJVU decode operations; correlate with inbound DJVU file uploads or processing requests around the time of the incident.

What your security team should do

• Apply the version upgrade to all ImageMagick installations within 30 days
• Inventory and restrict DJVU image processing where feasible
• Monitor process crash logs for ImageMagick-related segmentation faults