CVE-2026-116155

What it actually does

Memory leak triggered during XMP profile parsing in multiple image decoders, where crafted profile data causes allocations that are never freed, resulting in unbounded heap growth per processed image.

Why it matters to the business

Services that accept or process user-supplied images can exhaust available memory after repeated handling of malicious files, causing application crashes or system-level unavailability and interrupting image-related workflows.

How an attack unfolds

An attacker creates an image containing a specially malformed XMP profile, then repeatedly submits or causes the vulnerable ImageMagick installation to process that image through any affected decoder; each processing cycle leaks additional memory until the process or host runs out of resources and becomes unresponsive.

How to fix it

Upgrade ImageMagick to version 6.9.13-58 or newer for the 6.x branch and to 7.1.2-33 or newer for the 7.x branch; rebuild any dependent applications against the patched library and restart all services that load the library.

How to confirm the fix worked

Verify installed ImageMagick version strings match or exceed the fixed releases, then run a test suite that repeatedly decodes a crafted XMP-containing image while monitoring process memory usage to confirm the leak is absent.

Typical attack path

1. Locate any public or internal service that accepts image uploads or performs automated image decoding with ImageMagick
2. Craft a minimal valid image file embedding a malicious XMP profile designed to trigger the leak
3. Submit the image once or in high volume through the normal processing path
4. Monitor for progressive memory growth and eventual denial of service

How to detect it

Monitor image-processing services for sustained or sudden increases in resident memory size correlated with image-handling activity; review application and system logs for repeated decoding of the same or similar image files and correlate with memory-pressure events.

What your security team should do

• Immediately schedule patching of all ImageMagick installations to the fixed versions
• Inventory and prioritize external-facing image-processing services for earliest remediation
• Implement temporary resource limits or input-size restrictions on image-handling processes until patches are applied
• Add the vulnerable version check to routine vulnerability scanning and asset inventory