{"id":"CVE-2026-116154","kind":"vulnerability","aliases":["CVE-2026-116154"],"related":[],"title":"ImageMagick: XML nesting-limit path leaks memory, enabling denial of service","description":"ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in its XML parsing code, where allocated memory is not released when parsing reaches the nesting depth limit. Attackers can supply crafted, deeply nested XML data to trigger the leak, causing memory exhaustion and denial of service.","summary":"ImageMagick's XML parser fails to free allocated memory when input reaches the nesting depth limit. A remote attacker who supplies deeply nested XML can exhaust server memory and crash the process.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["image-processing","imagemagick","package","self-hosted"],"not_affected_if":["no-xml-formats","trusted-input-only"],"how_to_check":"- `magick -version` to read the installed ImageMagick version\n- Confirm whether the service reads XML-based image formats (SVG, MSL, XMP) from untrusted input","fix":"- Upgrade ImageMagick 6 to `6.9.13-58` or later\n- Upgrade ImageMagick 7 to `7.1.2-33` or later","status":"open","published_at":"2026-10-25T14:16:53+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","triaged_at":"2026-10-25T14:42:46+00:00","updated_at":"2026-10-25T14:42:46+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T14:42:46Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ImageMagick 6 to `6.9.13-58` or later\n- Upgrade ImageMagick 7 to `7.1.2-33` or later","reach":"internet","title":"ImageMagick: XML nesting-limit path leaks memory, enabling denial of service","impact":"low","summary":"ImageMagick's XML parser fails to free allocated memory when input reaches the nesting depth limit. A remote attacker who supplies deeply nested XML can exhaust server memory and crash the process.","category":"package","nicknames":[],"who_cares":["imagemagick","self-hosted","image-processing"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker exhausts server memory and crashes the ImageMagick process","analyst_note":"","how_to_check":"- `magick -version` to read the installed ImageMagick version\n- Confirm whether the service reads XML-based image formats (SVG, MSL, XMP) from untrusted input","needs_analyst":false,"not_affected_if":["trusted-input-only","no-xml-formats"],"who_is_affected":"Any service that runs ImageMagick on untrusted files or user uploads that may contain XML, such as SVG or metadata inputs, is exposed to memory exhaustion. Systems that only process trusted images, or that never hand XML-based formats to ImageMagick, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.00059,"input_tokens":3346,"output_tokens":511,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116154':15A,18A '-2026':14A,17A '-33':68C '-58':62C '6.9.13':61C '7':64C '7.1.2':67C 'alloc':34B,79C 'attack':45B,91C 'caus':103C 'code':77C 'contain':69C 'craft':94C 'crash':56B 'cve':13A,16A 'data':98C 'deepli':48B,95C 'denial':10A,107C 'depth':41B,89C 'enabl':9A 'exhaust':52B,105C 'fail':31B 'free':33B 'host':26B 'imag':20B 'image-process':19B 'imagemagick':1A,22B,27B,59C 'input':37B 'leak':7A,72C,102C 'limit':5A,42B,90C 'memori':8A,35B,54B,71C,80C,104C 'nest':4A,40B,49B,88C,96C 'nesting-limit':3A 'packag':23B 'pars':76C,85C 'parser':30B 'path':6A 'process':21B,58B 'reach':38B,86C 'releas':83C 'remot':44B 'self':25B 'self-host':24B 'server':53B 'servic':12A,109C 'suppli':47B,93C 'trigger':100C 'x':65C 'xml':2A,29B,50B,75C,97C","nicknames":[],"mitigations":[],"who_affected":"Any service that runs ImageMagick on untrusted files or user uploads that may contain XML, such as SVG or metadata inputs, is exposed to memory exhaustion. Systems that only process trusted images, or that never hand XML-based formats to ImageMagick, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:16:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116154","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116154","severity":null,"published_at":"2026-10-25T14:16:53+00:00","modified_at":"2026-10-25T14:16:53+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","fetched_at":"2026-10-25T14:41:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}