Live › vulnerability › CVE-2026-116154
Go to dashboardImageMagick's XML parser fails to free allocated memory when input reaches the nesting depth limit. A remote attacker who supplies deeply nested XML can exhaust server memory and crash the process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Any service that runs ImageMagick on untrusted files or user uploads that may contain XML, such as SVG or metadata inputs, is exposed to memory exhaustion. Systems that only process trusted images, or that never hand XML-based formats to ImageMagick, can skip it.
No product ranges from the sources yet.
magick -version to read the installed ImageMagick version6.9.13-58 or later7.1.2-33 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in its XML parsing code, where allocated memory is not released when parsing reaches the nesting depth limit. Attackers can supply crafted, deeply nested XML data to trigger the leak, causing memory exhaustion and denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-116154")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.