Cloudanix VulnDB

CVE-2026-116158

Low · 2.5

CVSS

2.5

EPSS

0.1%

Published

Oct 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in widely used image software can let someone make the program use up all available memory and stop working.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
High
Impact
Denial Of Service
Component
Application
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Memory leak in the magick compare command due to missing cleanup on operation failure, allowing repeated failed operations to exhaust available memory and trigger denial of service.

Why it matters to the business

Attackers with the ability to invoke the affected command can cause image processing services or applications to become unresponsive, leading to operational disruption and potential downtime for any workflows relying on ImageMagick.

How an attack unfolds

An attacker supplies specially crafted inputs that cause the compare operation to fail repeatedly; each failure leaks memory without cleanup, and sustained repetition exhausts system memory until the process or host becomes unresponsive.

How to fix it

Upgrade ImageMagick to version 7.1.2-33 or later; rebuild and redeploy any dependent applications or containers after the update.

How to confirm the fix worked

Verify the installed version reports 7.1.2-33 or newer; execute compare operations with known failing inputs and confirm memory usage remains stable without leaks.

Typical attack path

  1. Locate a system or application using a vulnerable ImageMagick version
  2. Gain the ability to invoke the magick compare command (local execution or via an exposed interface)
  3. Craft and submit inputs designed to trigger compare failures
  4. Repeat the failing operation at high volume to accelerate memory exhaustion
  5. Observe service degradation or crash confirming denial of service

How to detect it

Review process memory usage logs and application error logs for repeated compare command failures; correlate with spikes in memory consumption on hosts running ImageMagick.

What your security team should do

  • Prioritize patching ImageMagick installations that process untrusted inputs or are reachable by external users
  • Inventory all deployments and containers using ImageMagick and schedule upgrades within standard change windows
  • Restrict execution of the compare command to trusted contexts where possible until patches are applied
  • Monitor for high memory usage patterns in image-processing workloads as a temporary detection measure

The record

ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails. Attackers can supply inputs that trigger repeated failed compare operations to exhaust memory and cause denial of service.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities