{"id":"CVE-2026-116147","kind":"vulnerability","aliases":["CVE-2026-116147"],"related":[],"title":"ImageMagick: DJVU decoder crashes on failed allocation, enabling denial of service","description":"ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a null pointer dereference in the DJVU decoder because the result of a memory allocation is not checked before use. Attackers can supply a DJVU image that, when processed under conditions where the allocation fails, crashes the process and causes a denial of service.","summary":"ImageMagick's DJVU decoder uses the result of a memory allocation without checking it for failure. A crafted DJVU image processed while an allocation fails crashes the process, causing denial of service.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-upload","imagemagick","package","self-hosted"],"not_affected_if":["djvu-coder-disabled","no-djvu-input"],"how_to_check":"- Run `magick -version` and compare the reported version with the fixed releases\n- Check whether DJVU support is compiled in or whether the `DJVU` coder is enabled in `policy.xml`","fix":"- Upgrade ImageMagick 6 to `6.9.13-58` or later\n- Upgrade ImageMagick 7 to `7.1.2-33` or later\n- Until patched, disable the DJVU coder in `policy.xml` with `<policy domain=\"coder\" rights=\"none\" pattern=\"DJVU\" />`","status":"open","published_at":"2026-10-25T14:16:52+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","triaged_at":"2026-10-25T14:42:51+00:00","updated_at":"2026-10-25T14:42:51+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T14:42:51Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ImageMagick 6 to `6.9.13-58` or later\n- Upgrade ImageMagick 7 to `7.1.2-33` or later\n- Until patched, disable the DJVU coder in `policy.xml` with `<policy domain=\"coder\" rights=\"none\" pattern=\"DJVU\" />`","reach":"unknown","title":"ImageMagick: DJVU decoder crashes on failed allocation, enabling denial of service","impact":"low","summary":"ImageMagick's DJVU decoder uses the result of a memory allocation without checking it for failure. A crafted DJVU image processed while an allocation fails crashes the process, causing denial of service.","category":"package","nicknames":[],"who_cares":["imagemagick","self-hosted","file-upload"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Processing process crashes, causing denial of service on the host","analyst_note":"","how_to_check":"- Run `magick -version` and compare the reported version with the fixed releases\n- Check whether DJVU support is compiled in or whether the `DJVU` coder is enabled in `policy.xml`","needs_analyst":false,"not_affected_if":["no-djvu-input","djvu-coder-disabled"],"who_is_affected":"Systems that run ImageMagick and process DJVU files from users or external sources, such as upload handlers, thumbnail generators and document converters. Teams that never accept DJVU input or run ImageMagick without DJVU support can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000618,"input_tokens":3343,"output_tokens":568,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116147':14A,17A '-2026':13A,16A '-33':67C '-58':61C '6.9.13':60C '7':63C '7.1.2':66C 'alloc':7A,36B,49B,83C,102C 'attack':89C 'caus':54B,108C 'check':38B,86C 'condit':99C 'contain':68C 'craft':43B 'crash':4A,51B,104C 'cve':12A,15A 'decod':3A,29B,76C 'denial':9A,55B,110C 'derefer':72C 'djvu':2A,28B,44B,75C,93C 'enabl':8A 'fail':6A,50B,103C 'failur':41B 'file':19B 'file-upload':18B 'host':25B 'imag':45B,94C 'imagemagick':1A,21B,26B,58C 'memori':35B,82C 'null':70C 'packag':22B 'pointer':71C 'process':46B,53B,97C,106C 'result':32B,79C 'self':24B 'self-host':23B 'servic':11A,57B,112C 'suppli':91C 'upload':20B 'use':30B,88C 'without':37B 'x':64C","nicknames":[],"mitigations":[],"who_affected":"Systems that run ImageMagick and process DJVU files from users or external sources, such as upload handlers, thumbnail generators and document converters. Teams that never accept DJVU input or run ImageMagick without DJVU support can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:16:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116147","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116147","severity":null,"published_at":"2026-10-25T14:16:52+00:00","modified_at":"2026-10-25T14:16:52+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","fetched_at":"2026-10-25T14:41:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}