Live › vulnerability › CVE-2026-116157
Go to dashboardImageMagick versions before 7.1.2-33 leak memory in PerlMagick when image property values returned by reads are never freed. An attacker who can make the application repeatedly read image properties can exhaust memory and crash the service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Only teams that run ImageMagick through its PerlMagick Perl bindings and read image properties on behalf of untrusted input, such as image upload or conversion services. Command-line-only use of ImageMagick is not the affected path, and teams that do not use PerlMagick can skip it.
No product ranges from the sources yet.
magick -version and check whether the version is earlier than 7.1.2-33.Image::Magick) with perl -MImage::Magick -e 'print $Image::Magick::VERSION'.7.1.2-33 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading image properties. Attackers can repeatedly trigger property reads through five affected PerlMagick code locations to exhaust memory and cause denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-116157")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.