Live › vulnerability › CVE-2026-116143
Go to dashboardImageMagick's PostScript, PDF and XPS decoders ignore the security policy limit on how many scenes (pages or frames) a file may produce. A crafted file or argument can make it process more scenes than allowed, which can exhaust server memory or CPU.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Teams that run ImageMagick to convert or process user-supplied PostScript, PDF or XPS files, such as upload pipelines or thumbnail services. Systems that never pass those formats to ImageMagick, or that only process trusted files, are unlikely to be exposed to the resource exhaustion.
No product ranges from the sources yet.
magick -version and compare against the fixed releases: 6.9.13-58 and 7.1.2-33.grep -i scene /etc/ImageMagick-*/policy.xml.6.9.13-58 or later.7.1.2-33 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a policy bypass in the PS, PDF and XPS decoders that allows the security policy's list length limit on scene selection to be circumvented. Attackers supplying a specific argument can cause ImageMagick to process more scenes than permitted, potentially exhausting resources.
This page as .md · .json · in your agent: get_signal("CVE-2026-116143")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.