{"id":"CVE-2026-116141","kind":"vulnerability","aliases":["CVE-2026-116141"],"related":[],"title":"ImageMagick: UHDR decoder skips width and height policy limits before decoding","description":"ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because extent checks occur after decoding. Attackers can supply crafted UHDR images with oversized dimensions that are fully decoded before policy limits are enforced, causing excessive resource consumption.","summary":"ImageMagick checks image width and height limits only after the UHDR decoder has fully decoded the file, so the policy does not stop oversized images. An attacker who supplies a crafted UHDR image can make the server spend excessive memory and CPU on it.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["image-processing","imagemagick","package","self-hosted"],"not_affected_if":["no-untrusted-images","uhdr-not-used"],"how_to_check":"- Run `magick -version` and compare against `7.1.2-33`\n- Check whether UHDR (`.uhdr`/`.jpg` with UHDR gain map) input is accepted from untrusted users, and whether `policy.xml` sets width or height limits","fix":"- Upgrade ImageMagick to `7.1.2-33` or later\n- Until patched, reject UHDR input from untrusted sources","status":"open","published_at":"2026-10-25T14:16:51+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","triaged_at":"2026-10-25T14:42:47+00:00","updated_at":"2026-10-25T14:42:47+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T14:42:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ImageMagick to `7.1.2-33` or later\n- Until patched, reject UHDR input from untrusted sources","reach":"unknown","title":"ImageMagick: UHDR decoder skips width and height policy limits before decoding","impact":"low","summary":"ImageMagick checks image width and height limits only after the UHDR decoder has fully decoded the file, so the policy does not stop oversized images. An attacker who supplies a crafted UHDR image can make the server spend excessive memory and CPU on it.","category":"package","nicknames":[],"who_cares":["imagemagick","self-hosted","image-processing"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Server memory and CPU exhausted by oversized image decoding","analyst_note":"","how_to_check":"- Run `magick -version` and compare against `7.1.2-33`\n- Check whether UHDR (`.uhdr`/`.jpg` with UHDR gain map) input is accepted from untrusted users, and whether `policy.xml` sets width or height limits","needs_analyst":false,"not_affected_if":["no-untrusted-images","uhdr-not-used"],"who_is_affected":"Services that run ImageMagick on user-uploaded images, such as thumbnailers, upload pipelines and image conversion APIs, are exposed if they accept UHDR input. Systems that never process untrusted images, or that only handle trusted files, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000604,"input_tokens":3342,"output_tokens":539,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116141':14A,17A '-2026':13A,16A '-33':71C '7.1.2':70C 'allow':82C 'attack':52B,83C,97C 'bypass':75C 'caus':115C 'check':27B,93C 'consumpt':118C 'contain':72C 'cpu':67B 'craft':56B,100C 'cve':12A,15A 'decod':3A,11A,37B,40B,80C,96C,109C 'dimens':105C 'enforc':114C 'evad':85C 'excess':64B,116C 'extent':92C 'file':42B 'fulli':39B,108C 'height':7A,31B,89C 'host':25B 'imag':19B,28B,50B,58B,86C,102C 'image-process':18B 'imagemagick':1A,21B,26B,68C 'limit':9A,32B,90C,112C 'make':60B 'memori':65B 'occur':94C 'overs':49B,104C 'packag':22B 'polici':8A,45B,74C,111C 'process':20B 'resourc':117C 'self':24B 'self-host':23B 'server':62B 'skip':4A 'spend':63B 'stop':48B 'suppli':54B,99C 'uhdr':2A,36B,57B,79C,101C 'vulner':76C 'width':5A,29B,87C","nicknames":[],"mitigations":[],"who_affected":"Services that run ImageMagick on user-uploaded images, such as thumbnailers, upload pipelines and image conversion APIs, are exposed if they accept UHDR input. Systems that never process untrusted images, or that only handle trusted files, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:16:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116141","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116141","severity":null,"published_at":"2026-10-25T14:16:51+00:00","modified_at":"2026-10-25T14:16:51+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","fetched_at":"2026-10-25T14:41:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}