{"id":"CVE-2026-116143","kind":"vulnerability","aliases":["CVE-2026-116143"],"related":[],"title":"ImageMagick: PS, PDF and XPS decoders bypass scene-count policy limit","description":"ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a policy bypass in the PS, PDF and XPS decoders that allows the security policy's list length limit on scene selection to be circumvented. Attackers supplying a specific argument can cause ImageMagick to process more scenes than permitted, potentially exhausting resources.","summary":"ImageMagick's PostScript, PDF and XPS decoders ignore the security policy limit on how many scenes (pages or frames) a file may produce. A crafted file or argument can make it process more scenes than allowed, which can exhaust server memory or CPU.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["image-processing","imagemagick","package","self-hosted"],"not_affected_if":["no-ps-pdf-xps-input","trusted-input-only"],"how_to_check":"- Run `magick -version` and compare against the fixed releases: `6.9.13-58` and `7.1.2-33`.\n- Check whether a policy file sets a scene limit for these formats: `grep -i scene /etc/ImageMagick-*/policy.xml`.","fix":"- Upgrade ImageMagick 6 to `6.9.13-58` or later.\n- Upgrade ImageMagick 7 to `7.1.2-33` or later.","status":"open","published_at":"2026-10-25T14:16:52+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","triaged_at":"2026-10-25T14:44:13+00:00","updated_at":"2026-10-25T14:44:13+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T14:44:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ImageMagick 6 to `6.9.13-58` or later.\n- Upgrade ImageMagick 7 to `7.1.2-33` or later.","reach":"unknown","title":"ImageMagick: PS, PDF and XPS decoders bypass scene-count policy limit","impact":"low","summary":"ImageMagick's PostScript, PDF and XPS decoders ignore the security policy limit on how many scenes (pages or frames) a file may produce. A crafted file or argument can make it process more scenes than allowed, which can exhaust server memory or CPU.","category":"package","nicknames":[],"who_cares":["imagemagick","self-hosted","image-processing"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker exhausts server memory or CPU by forcing excess scene processing.","analyst_note":"","how_to_check":"- Run `magick -version` and compare against the fixed releases: `6.9.13-58` and `7.1.2-33`.\n- Check whether a policy file sets a scene limit for these formats: `grep -i scene /etc/ImageMagick-*/policy.xml`.","needs_analyst":false,"not_affected_if":["no-ps-pdf-xps-input","trusted-input-only"],"who_is_affected":"Teams that run ImageMagick to convert or process user-supplied PostScript, PDF or XPS files, such as upload pipelines or thumbnail services. Systems that never pass those formats to ImageMagick, or that only process trusted files, are unlikely to be exposed to the resource exhaustion.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000631,"input_tokens":3356,"output_tokens":590,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116143':15A,18A '-2026':14A,17A '-33':79C '-58':73C '6.9.13':72C '7':75C '7.1.2':78C 'allow':62B,92C 'argument':54B,110C 'attack':106C 'bypass':7A,83C 'caus':112C 'circumv':105C 'contain':80C 'count':10A 'cpu':69B 'craft':51B 'cve':13A,16A 'decod':6A,33B,90C 'exhaust':65B,121C 'file':47B,52B 'frame':45B 'host':26B 'ignor':34B 'imag':20B 'image-process':19B 'imagemagick':1A,22B,27B,70C,113C 'length':98C 'limit':12A,38B,99C 'list':97C 'make':56B 'mani':41B 'may':48B 'memori':67B 'packag':23B 'page':43B 'pdf':3A,30B,87C 'permit':119C 'polici':11A,37B,82C,95C 'postscript':29B 'potenti':120C 'process':21B,58B,115C 'produc':49B 'ps':2A,86C 'resourc':122C 'scene':9A,42B,60B,101C,117C 'scene-count':8A 'secur':36B,94C 'select':102C 'self':25B 'self-host':24B 'server':66B 'specif':109C 'suppli':107C 'x':76C 'xps':5A,32B,89C","nicknames":[],"mitigations":[],"who_affected":"Teams that run ImageMagick to convert or process user-supplied PostScript, PDF or XPS files, such as upload pipelines or thumbnail services. Systems that never pass those formats to ImageMagick, or that only process trusted files, are unlikely to be exposed to the resource exhaustion.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:16:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116143","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116143","severity":null,"published_at":"2026-10-25T14:16:52+00:00","modified_at":"2026-10-25T14:16:52+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","fetched_at":"2026-10-25T14:41:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}