{"id":"CVE-2026-116157","kind":"vulnerability","aliases":["CVE-2026-116157"],"related":[],"title":"ImageMagick PerlMagick: memory leak in image property reads enables denial of service","description":"ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading image properties. Attackers can repeatedly trigger property reads through five affected PerlMagick code locations to exhaust memory and cause denial of service.","summary":"ImageMagick versions before 7.1.2-33 leak memory in PerlMagick when image property values returned by reads are never freed. An attacker who can make the application repeatedly read image properties can exhaust memory and crash the service.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["imagemagick","package","perl","perlmagick","self-hosted"],"not_affected_if":["command-line-only","no-perlmagick","no-untrusted-image-input"],"how_to_check":"- Run `magick -version` and check whether the version is earlier than `7.1.2-33`.\n- Check whether the application loads the PerlMagick module (`Image::Magick`) with `perl -MImage::Magick -e 'print $Image::Magick::VERSION'`.","fix":"- Upgrade ImageMagick to `7.1.2-33` or later.\n- Restart long-running PerlMagick processes after upgrading so the fixed library is loaded.","status":"open","published_at":"2026-10-25T14:16:54+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","triaged_at":"2026-10-25T14:43:07+00:00","updated_at":"2026-10-25T14:43:07+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T14:43:07Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ImageMagick to `7.1.2-33` or later.\n- Restart long-running PerlMagick processes after upgrading so the fixed library is loaded.","reach":"unknown","title":"ImageMagick PerlMagick: memory leak in image property reads enables denial of service","impact":"low","summary":"ImageMagick versions before 7.1.2-33 leak memory in PerlMagick when image property values returned by reads are never freed. An attacker who can make the application repeatedly read image properties can exhaust memory and crash the service.","category":"package","nicknames":[],"who_cares":["imagemagick","perlmagick","perl","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Repeated requests exhaust server memory and crash the service.","analyst_note":"","how_to_check":"- Run `magick -version` and check whether the version is earlier than `7.1.2-33`.\n- Check whether the application loads the PerlMagick module (`Image::Magick`) with `perl -MImage::Magick -e 'print $Image::Magick::VERSION'`.","needs_analyst":false,"not_affected_if":["no-perlmagick","command-line-only","no-untrusted-image-input"],"who_is_affected":"Only teams that run ImageMagick through its PerlMagick Perl bindings and read image properties on behalf of untrusted input, such as image upload or conversion services. Command-line-only use of ImageMagick is not the affected path, and teams that do not use PerlMagick can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000615,"input_tokens":3318,"output_tokens":567,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116157':15A,18A '-2026':14A,17A '-33':30B,66C '7.1.2':29B,65C 'affect':92C 'applic':51B 'attack':46B,84C 'caus':100C 'code':94C 'contain':67C 'crash':60B 'cve':13A,16A 'denial':10A,101C 'enabl':9A 'exhaust':57B,97C 'fail':75C 'five':91C 'free':77C 'freed':44B 'host':25B 'imag':6A,36B,54B,82C 'imagemagick':1A,19B,26B,63C 'leak':4A,31B,70C 'locat':95C 'make':49B 'memori':3A,32B,58B,69C,98C 'never':43B 'packag':20B 'perl':21B 'perlmagick':2A,22B,34B,73C,93C 'properti':7A,37B,55B,83C,88C 'read':8A,41B,53B,81C,89C 'repeat':52B,86C 'return':39B,79C 'self':24B 'self-host':23B 'servic':12A,62B,103C 'trigger':87C 'valu':38B,78C 'version':27B 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Only teams that run ImageMagick through its PerlMagick Perl bindings and read image properties on behalf of untrusted input, such as image upload or conversion services. Command-line-only use of ImageMagick is not the affected path, and teams that do not use PerlMagick can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:16:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116157","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116157","severity":null,"published_at":"2026-10-25T14:16:54+00:00","modified_at":"2026-10-25T14:16:54+00:00","first_seen_at":"2026-10-25T14:41:22+00:00","fetched_at":"2026-10-25T14:41:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}