---
id: "CVE-2026-116141"
kind: "vulnerability"
aliases: ["CVE-2026-116141"]
title: "ImageMagick: UHDR decoder skips width and height policy limits before decoding"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["image-processing", "imagemagick", "package", "self-hosted"]
not_affected_if: ["no-untrusted-images", "uhdr-not-used"]
published_at: "2026-10-25T14:16:51+00:00"
first_seen_at: "2026-10-25T14:41:22+00:00"
updated_at: "2026-10-25T14:42:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116141", "first_seen_at": "2026-10-25T14:41:22+00:00"}]
---

# ImageMagick: UHDR decoder skips width and height policy limits before decoding

ImageMagick checks image width and height limits only after the UHDR decoder has fully decoded the file, so the policy does not stop oversized images. An attacker who supplies a crafted UHDR image can make the server spend excessive memory and CPU on it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `magick -version` and compare against `7.1.2-33`
- Check whether UHDR (`.uhdr`/`.jpg` with UHDR gain map) input is accepted from untrusted users, and whether `policy.xml` sets width or height limits

## Fix

- Upgrade ImageMagick to `7.1.2-33` or later
- Until patched, reject UHDR input from untrusted sources

## Timeline

- 2026-10-25T14:41:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116141

## From the sources

ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because extent checks occur after decoding. Attackers can supply crafted UHDR images with oversized dimensions that are fully decoded before policy limits are enforced, causing excessive resource consumption.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_