Live › vulnerability › CVE-2026-116147
Go to dashboardImageMagick's DJVU decoder uses the result of a memory allocation without checking it for failure. A crafted DJVU image processed while an allocation fails crashes the process, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Systems that run ImageMagick and process DJVU files from users or external sources, such as upload handlers, thumbnail generators and document converters. Teams that never accept DJVU input or run ImageMagick without DJVU support can skip it.
No product ranges from the sources yet.
magick -version and compare the reported version with the fixed releasesDJVU coder is enabled in policy.xml6.9.13-58 or later7.1.2-33 or laterpolicy.xml with <policy domain="coder" rights="none" pattern="DJVU" />Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a null pointer dereference in the DJVU decoder because the result of a memory allocation is not checked before use. Attackers can supply a DJVU image that, when processed under conditions where the allocation fails, crashes the process and causes a denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-116147")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.