CVE-2026-116154

What it actually does

Memory leak in XML parsing code where allocated memory is not freed upon reaching nesting depth limit, enabling repeated allocation without release until memory exhaustion occurs.

Why it matters to the business

Attackers can remotely disrupt image processing services, causing outages or degraded performance with minimal effort; recent publication increases urgency for organizations relying on the affected software.

How an attack unfolds

An attacker crafts deeply nested XML input and supplies it to the vulnerable XML parsing routines in ImageMagick, triggering repeated memory allocations that are never released once the depth limit is hit, eventually exhausting available memory and denying service to legitimate users.

How to fix it

Upgrade ImageMagick to version 6.9.13-58 or later for the 6.x branch and 7.1.2-33 or later for the 7.x branch; rebuild any dependent applications against the patched library and restart affected services.

How to confirm the fix worked

Confirm installed version meets or exceeds the fixed releases, then attempt to process a test payload that reaches the nesting depth limit and verify memory usage returns to baseline after parsing completes.

Typical attack path

1. Identify an ImageMagick instance accepting untrusted XML input via image files or policy definitions.
2. Generate a crafted XML payload with excessive nesting depth exceeding the configured limit.
3. Deliver the payload through supported channels such as image conversion requests or policy loading.
4. Observe progressive memory growth in the process until exhaustion forces denial of service.

How to detect it

Inspect system and application logs for ImageMagick processes showing sustained memory growth or out-of-memory events correlated with XML-heavy image processing requests; review process accounting for unexpected spikes in resident set size.

What your security team should do

• Prioritize patching within the next maintenance window given the one-day publication age and remote unauthenticated attack vector.
• Review and restrict XML or image processing inputs from untrusted sources until upgrades are complete.
• Monitor memory utilization of ImageMagick processes for anomalous growth patterns.