Cloudanix VulnDB

CVE-2026-116157

Low · 3.3

CVSS

3.3

EPSS

0.1%

Published

Oct 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in image-processing software can let repeated operations slowly use up all available memory, eventually crashing programs that handle pictures.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Memory leak in PerlMagick fails to release memory allocated for image property values at five code paths, allowing repeated property reads to exhaust available RAM and trigger denial of service.

Why it matters to the business

Applications or services that process images through PerlMagick can experience gradual or rapid memory exhaustion, leading to crashes, degraded performance, or service outages that disrupt image-handling workflows.

How an attack unfolds

An attacker supplies specially crafted images or Perl scripts that repeatedly invoke the affected property-read routines; because returned values are never freed, memory consumption grows until the process or system runs out of resources and becomes unresponsive.

How to fix it

Upgrade ImageMagick to version 7.1.2-33 or later; rebuild or reinstall PerlMagick bindings after the core library update; test image-processing scripts under load to confirm the leak is resolved.

How to confirm the fix worked

Run memory-profiling tools against the updated PerlMagick code while exercising the five affected property-read locations; confirm that allocated property values are freed after each read and that memory usage remains stable under repeated calls.

Typical attack path

  1. Identify or deploy Perl code that uses ImageMagick PerlMagick to read image metadata or properties
  2. Craft or obtain image files that trigger the vulnerable property-read paths
  3. Repeatedly invoke the property-read operations in a loop or via automated input
  4. Monitor memory usage until exhaustion occurs and the target process terminates or hangs

How to detect it

Review system and application logs for Perl processes that show steadily increasing memory usage or out-of-memory kills; correlate with image-processing activity or recent introduction of new image files.

What your security team should do

  • Prioritize upgrade of ImageMagick and PerlMagick to 7.1.2-33+ within the next patching cycle
  • Inventory all Perl scripts or services that import Image::Magick and schedule regression testing
  • Implement resource limits or container memory caps on image-processing workloads until patched
  • Monitor for unusual memory growth in Perl processes handling images

The record

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading image properties. Attackers can repeatedly trigger property reads through five affected PerlMagick code locations to exhaust memory and cause denial of service.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities