{"id":"CVE-2026-116150","kind":"vulnerability","aliases":["CVE-2026-116150"],"related":[],"title":"ImageMagick: FPX encoder memory leak lets crafted images exhaust server memory","description":"ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the FPX encoder that allows attackers to exhaust memory by supplying a crafted image. Attackers can submit crafted images for FPX encoding to leak memory repeatedly, causing resource exhaustion and denial of service.","summary":"ImageMagick before 7.1.2-33 leaks memory in its FPX encoder when it processes a crafted image. Repeated submissions exhaust memory and cause a denial of service.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["imagemagick","package","self-hosted"],"not_affected_if":["no-fpx-encoding","trusted-input-only"],"how_to_check":"- `magick -version` to read the installed ImageMagick version\n- Check whether FPX encoding is reachable from your application, for example a service that converts user uploads to FPX","fix":"- Upgrade ImageMagick to `7.1.2-33` or later\n- Until upgraded, reject or do not convert user-supplied images to FPX","status":"open","published_at":"2026-10-25T14:16:53+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","triaged_at":"2026-10-25T14:44:16+00:00","updated_at":"2026-10-25T14:44:16+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T14:44:16Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ImageMagick to `7.1.2-33` or later\n- Until upgraded, reject or do not convert user-supplied images to FPX","reach":"internet","title":"ImageMagick: FPX encoder memory leak lets crafted images exhaust server memory","impact":"low","summary":"ImageMagick before 7.1.2-33 leaks memory in its FPX encoder when it processes a crafted image. Repeated submissions exhaust memory and cause a denial of service.","category":"package","nicknames":[],"who_cares":["imagemagick","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Repeated crafted uploads exhaust server memory and crash the service","analyst_note":"","how_to_check":"- `magick -version` to read the installed ImageMagick version\n- Check whether FPX encoding is reachable from your application, for example a service that converts user uploads to FPX","needs_analyst":false,"not_affected_if":["no-fpx-encoding","trusted-input-only"],"who_is_affected":"Teams running ImageMagick versions before 7.1.2-33 that accept untrusted images and convert them to FPX format. Systems that never encode FPX, or that only process trusted images, are much less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000568,"input_tokens":3330,"output_tokens":471,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-116150':14A,17A '-2026':13A,16A '-33':26B,52C '7.1.2':25B,51C 'allow':63C 'attack':64C,73C 'caus':44B,85C 'contain':53C 'craft':7A,37B,71C,76C 'cve':12A,15A 'denial':46B,89C 'encod':3A,32B,61C,80C 'exhaust':9A,41B,66C,87C 'fpx':2A,31B,60C,79C 'host':22B 'imag':8A,38B,72C,77C 'imagemagick':1A,18B,23B,49C 'leak':5A,27B,56C,82C 'let':6A 'memori':4A,11A,28B,42B,55C,67C,83C 'packag':19B 'process':35B 'repeat':39B,84C 'resourc':86C 'self':21B 'self-host':20B 'server':10A 'servic':48B,91C 'submiss':40B 'submit':75C 'suppli':69C 'vulner':57C","nicknames":[],"mitigations":[],"who_affected":"Teams running ImageMagick versions before 7.1.2-33 that accept untrusted images and convert them to FPX format. Systems that never encode FPX, or that only process trusted images, are much less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:16:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116150","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116150","severity":null,"published_at":"2026-10-25T14:16:53+00:00","modified_at":"2026-10-25T14:16:53+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","fetched_at":"2026-10-25T14:41:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}