---
id: "CVE-2026-116154"
kind: "vulnerability"
aliases: ["CVE-2026-116154"]
title: "ImageMagick: XML nesting-limit path leaks memory, enabling denial of service"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["image-processing", "imagemagick", "package", "self-hosted"]
not_affected_if: ["no-xml-formats", "trusted-input-only"]
published_at: "2026-10-25T14:16:53+00:00"
first_seen_at: "2026-10-25T14:41:22+00:00"
updated_at: "2026-10-25T14:42:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116154", "first_seen_at": "2026-10-25T14:41:22+00:00"}]
---

# ImageMagick: XML nesting-limit path leaks memory, enabling denial of service

ImageMagick's XML parser fails to free allocated memory when input reaches the nesting depth limit. A remote attacker who supplies deeply nested XML can exhaust server memory and crash the process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `magick -version` to read the installed ImageMagick version
- Confirm whether the service reads XML-based image formats (SVG, MSL, XMP) from untrusted input

## Fix

- Upgrade ImageMagick 6 to `6.9.13-58` or later
- Upgrade ImageMagick 7 to `7.1.2-33` or later

## Timeline

- 2026-10-25T14:41:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116154

## From the sources

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in its XML parsing code, where allocated memory is not released when parsing reaches the nesting depth limit. Attackers can supply crafted, deeply nested XML data to trigger the leak, causing memory exhaustion and denial of service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_