Live › vulnerability › CVE-2026-116151
Go to dashboardImageMagick's JNG encoder fails to free allocated memory when it processes a crafted image. An attacker who supplies such images can exhaust memory and cause a limited denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Systems that run ImageMagick versions before 6.9.13-58 or 7.x before 7.1.2-33 and encode images to JNG, especially when the images come from untrusted users. Systems that do not run ImageMagick, or that never encode to JNG from outside input, are unlikely to be exposed.
No product ranges from the sources yet.
magick -version (or convert -version) and compare the reported version with the fixed releases below.6.9.13-58 or later.7.1.2-33 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the JNG encoder that fails to release allocated memory when processing a crafted image. Attackers can supply crafted images that are encoded to JNG to leak memory, potentially causing resource exhaustion and a limited denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-116151")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.