Live › vulnerability › CVE-2026-116155
Go to dashboardImageMagick leaks memory each time a decoder processes an image carrying a crafted XMP profile. An attacker who can submit images can drive resource exhaustion and cause a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Any service that runs ImageMagick on images from users or other untrusted sources is exposed, because the crafted XMP profile is embedded in the image itself. Systems that only process images they create or control can skip it.
No product ranges from the sources yet.
magick -version or convert -version and compare with the fixed releases.6.9.13-58 or later.7.1.2-33 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of XMP profiles by various decoders. Attackers can supply images with a crafted XMP profile that leak memory each time they are processed, leading to resource exhaustion and denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-116155")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.