{"id":"CVE-2026-116155","kind":"vulnerability","aliases":["CVE-2026-116155"],"related":[],"title":"ImageMagick: crafted XMP profiles leak memory and exhaust server resources","description":"ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of XMP profiles by various decoders. Attackers can supply images with a crafted XMP profile that leak memory each time they are processed, leading to resource exhaustion and denial of service.","summary":"ImageMagick leaks memory each time a decoder processes an image carrying a crafted XMP profile. An attacker who can submit images can drive resource exhaustion and cause a denial of service.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["image-processing","imagemagick","package","self-hosted"],"not_affected_if":["trusted-input-only"],"how_to_check":"- Run `magick -version` or `convert -version` and compare with the fixed releases.\n- Check whether services accept user-supplied images and pass them to ImageMagick.","fix":"- Upgrade ImageMagick 6 to `6.9.13-58` or later.\n- Upgrade ImageMagick 7 to `7.1.2-33` or later.","status":"open","published_at":"2026-10-25T14:16:53+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","triaged_at":"2026-10-25T14:42:43+00:00","updated_at":"2026-10-25T14:42:43+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T14:42:43Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ImageMagick 6 to `6.9.13-58` or later.\n- Upgrade ImageMagick 7 to `7.1.2-33` or later.","reach":"internet","title":"ImageMagick: crafted XMP profiles leak memory and exhaust server resources","impact":"low","summary":"ImageMagick leaks memory each time a decoder processes an image carrying a crafted XMP profile. An attacker who can submit images can drive resource exhaustion and cause a denial of service.","category":"package","nicknames":[],"who_cares":["imagemagick","self-hosted","image-processing"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Repeated processing exhausts server memory and causes denial of service","analyst_note":"","how_to_check":"- Run `magick -version` or `convert -version` and compare with the fixed releases.\n- Check whether services accept user-supplied images and pass them to ImageMagick.","needs_analyst":false,"not_affected_if":["trusted-input-only"],"who_is_affected":"Any service that runs ImageMagick on images from users or other untrusted sources is exposed, because the crafted XMP profile is embedded in the image itself. Systems that only process images they create or control can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00057,"input_tokens":3332,"output_tokens":473,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116155':13A,16A '-2026':12A,15A '-33':65C '-58':59C '6.9.13':58C '7':61C '7.1.2':64C 'attack':41B,79C 'carri':35B 'caus':51B 'contain':66C 'craft':2A,37B,85C 'cve':11A,14A 'decod':31B,78C 'denial':53B,101C 'drive':47B 'exhaust':8A,49B,99C 'handl':72C 'host':24B 'imag':18B,34B,45B,82C 'image-process':17B 'imagemagick':1A,20B,25B,56C 'lead':96C 'leak':5A,26B,69C,89C 'memori':6A,27B,68C,90C 'packag':21B 'process':19B,32B,95C 'profil':4A,39B,75C,87C 'resourc':10A,48B,98C 'self':23B 'self-host':22B 'server':9A 'servic':55B,103C 'submit':44B 'suppli':81C 'time':29B,92C 'various':77C 'x':62C 'xmp':3A,38B,74C,86C","nicknames":[],"mitigations":[],"who_affected":"Any service that runs ImageMagick on images from users or other untrusted sources is exposed, because the crafted XMP profile is embedded in the image itself. Systems that only process images they create or control can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:16:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116155","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116155","severity":null,"published_at":"2026-10-25T14:16:53+00:00","modified_at":"2026-10-25T14:16:53+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","fetched_at":"2026-10-25T14:41:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}