Live › vulnerability › CVE-2026-116156
Go to dashboardImageMagick leaks memory when the -set profile option is used because a cleanup step is missing. An attacker who gets a user to process images with that option can exhaust server memory and cause a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Systems that run ImageMagick and pass user-supplied images through the -set profile option are exposed to memory exhaustion. Teams that do not run ImageMagick, or that only process trusted images with fixed command lines, can skip it.
No product ranges from the sources yet.
magick -version or convert -version and compare against the fixed versions below-set profile usage on untrusted input6.9.13-58 or later7.1.2-33 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak caused by a missing cleanup when the -set profile option is used. An attacker who induces a user to process images with the -set profile option can leak memory, potentially exhausting resources and causing a denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-116156")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.