CVE-2026-116156

What it actually does

Memory leak in ImageMagick triggered by missing cleanup logic when the -set profile option is invoked during image processing.

Why it matters to the business

Resource exhaustion can render image-processing workloads unavailable, disrupting any dependent services or pipelines until the affected process is restarted or the system is rebooted.

How an attack unfolds

An attacker supplies an image or command line that exercises the -set profile option; each invocation allocates memory that is never freed, gradually depleting available RAM until the process or host becomes unresponsive.

How to fix it

Upgrade ImageMagick to version 6.9.13-58 or newer (6.x branch) or 7.1.2-33 or newer (7.x branch). Where immediate patching is not possible, restrict use of the -set profile option to trusted inputs only.

How to confirm the fix worked

Confirm the installed ImageMagick version meets or exceeds the fixed releases; execute a controlled test using the -set profile option and monitor memory consumption to verify the leak is absent.

Typical attack path

1. Locate systems or workflows that invoke ImageMagick with the -set profile option
2. Prepare an input image or command that repeatedly triggers the option
3. Convince a user or automated process to execute the command or process the image
4. Observe sustained memory growth until denial of service occurs

How to detect it

Review process accounting and system logs for ImageMagick invocations containing the -set profile flag; correlate with host-level memory-utilization metrics that show unexplained, sustained growth.

What your security team should do

• Apply the vendor-supplied update to all ImageMagick installations within the next maintenance window
• Audit scripts and applications for use of the -set profile option and remove it where unnecessary
• Implement resource limits or container isolation around ImageMagick processes to contain memory growth