Cloudanix VulnDB

CVE-2026-116151

Low · 3.7

CVSS

3.7

EPSS

0.3%

Published

Oct 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in widely used image software can let attackers waste computer memory by sending specially made pictures, which may slow down or briefly interrupt services that work with images.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Denial Of Service
Component
Library
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Memory leak in the JNG encoder that fails to release allocated memory when processing a crafted image, leading to gradual resource exhaustion.

Why it matters to the business

Applications handling images may experience increasing memory consumption, degraded performance, or limited denial of service when processing untrusted inputs, affecting availability of image-processing services.

How an attack unfolds

An attacker supplies a specially crafted image that triggers the JNG encoding code path in ImageMagick; repeated processing of such images causes unreleased memory allocations to accumulate until system resources are exhausted.

How to fix it

Upgrade ImageMagick to version 6.9.13-58 or 7.1.2-33 or later; apply vendor patches if available for downstream packages.

How to confirm the fix worked

Verify installed ImageMagick version meets or exceeds 6.9.13-58 / 7.1.2-33; test image processing workflows with known-good and crafted inputs while monitoring memory usage.

Typical attack path

  1. Identify a target application or service that uses ImageMagick to process or encode images to JNG format
  2. Craft and submit a malicious image designed to trigger the memory leak in the JNG encoder
  3. Repeat submissions to accumulate leaked memory and induce resource exhaustion

How to detect it

Monitor for steadily increasing memory usage in processes using ImageMagick during image encoding operations; review application logs for repeated JNG-related processing of external images.

What your security team should do

  • Prioritize upgrade of ImageMagick installations to the fixed versions
  • Restrict untrusted image inputs or implement sandboxing around image processing
  • Monitor memory consumption metrics for image-handling services

The record

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the JNG encoder that fails to release allocated memory when processing a crafted image. Attackers can supply crafted images that are encoded to JNG to leak memory, potentially causing resource exhaustion and a limited denial of service.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities